{
  "family": "itranslator",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "Adware/PUP:Win32/Itranslator is a Potentially Unwanted Program (PUP) categorized as an Adware or Browser Modifier. It is ostensibly marketed as a helpful browser extension or desktop utility for translating web pages. However, its true purpose is aggressive monetization: it hijacks browser settings, injects unremovable advertisements, redirects search traffic, and tracks browsing habits without informed consent.<br><br><b>Understanding Itranslator</b><br>To an end-user, Itranslator severely degrades the web browsing experience, flooding pages with pop-ups and slowing down the browser. For a security operations center (SOC), it is a 'nuisance' threat that indicates poor endpoint hygiene and risky user behavior. While not typically destructive, the infrastructure used to deliver adware is frequently repurposed to deliver more severe malware (malvertising).<br><br><b>Execution and Hijacking Mechanics</b><br>Itranslator is almost exclusively distributed via 'bundling'—it is hidden within the installers of other free software downloaded from unverified third-party portals (`T1189`). During installation, if the user clicks 'Express Install', the PUP is silently installed. Once active, it forcefully modifies browser settings (Chrome, Edge, Firefox), installing unauthorized extensions (`T1176`) and changing the default search engine (`T1562.001`). It establishes persistence via Scheduled Tasks or Registry Run keys to ensure the malicious extensions are re-installed if the user attempts to remove them.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a degraded user experience, potential exposure to malvertising, and privacy violations (tracking). Host-based IoCs include the presence of unwanted extensions in the browser's add-on manager, unexpected modifications to the `Start Page` registry keys, and anomalous Scheduled Tasks running browser executables with hidden command-line arguments. Network IoCs involve constant HTTP/HTTPS traffic to known adware tracking networks and affiliate marketing domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1189",
    "T1176"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1176",
      "name": "Browser Extensions (Force-installing adware extensions)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Hijacking default search and homepage)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Distribution via deceptive software bundles)",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Use the Windows 'Programs and Features' control panel to uninstall the Itranslator application and any related unknown software.",
    "Perform a full reset of all installed web browsers to clear out the hijacked homepages, search engines, and malicious extensions.",
    "Audit the Windows Task Scheduler and remove any persistent tasks created by the adware to reinstall itself.",
    "Run a scan with a reputable enterprise-grade PUP/Adware removal tool to ensure all registry hooks are cleaned."
  ],
  "what_to_avoid": [
    "Do not allow users to download software from third-party freeware portals; enforce application whitelisting.",
    "Avoid simply changing the homepage back manually; you must remove the underlying extension and persistence mechanisms."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}