{
  "family": "1clickdownload",
  "sample_count": 26,
  "category": "adware",
  "description": "1ClickDownload (classified across security intelligence databases under signatures including SoftwareBundler:Win32/1ClickDownload, PUA:Win32/1ClickDownload, and Adware:Win32/1ClickDownload) is an aggressive software monetization wrapper and adware bundler active since 2013. Designed to monetize media downloads from video streaming and file-sharing sites, 1ClickDownload presents itself as a streamlined single-click download acceleration client. During installation, it employs deceptive user interface patterns (dark patterns) with pre-checked opt-in boxes to download and install secondary advertising payloads, search hijackers, and unauthorized browser helper objects. Once active on the host, 1ClickDownload intercepts browser HTTP traffic, redirects default search engine queries to sponsored monetization endpoints, and periodically pops up full-screen promotional ads, degrading system responsiveness and compromising user browsing privacy.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "SoftwareBundler:Win32/1ClickDownload",
    "PUA:Win32/1ClickDownload",
    "Adware:Win32/1ClickDownload",
    "Win32/1ClickDownload",
    "1ClickDownload Bundler"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is SoftwareBundler:Win32/1ClickDownload?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "1ClickDownload is a deceptive software bundler and adware program that installs unwanted advertising payloads and hijacks browser searches."
      }
    },
    {
      "@type": "Question",
      "name": "How does 1ClickDownload get installed onto computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with free media players, video downloaders, and file-sharing utilities using deceptive pre-checked opt-in screens."
      }
    },
    {
      "@type": "Question",
      "name": "What changes does 1ClickDownload make to web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies default search providers, alters browser homepages, and installs rogue extensions that inject banner advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How does 1ClickDownload maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart registry entries in CurrentVersion\\Run and registers background scheduled tasks to keep itself running."
      }
    },
    {
      "@type": "Question",
      "name": "How do you remove 1ClickDownload completely?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall rogue entries via Windows Installed Apps, reset browser settings to factory defaults, and run a full scan with Microsoft Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1059.007",
    "T1112",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Bundlers",
    "Video Downloader Landing Pages",
    "Torrent File Repackagers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Deceptive Secondary Adware Bundling",
    "Browser Search Engine Query Redirection",
    "Pop-Up & Pop-Under Ad Display",
    "User Browsing Telemetry Harvesting",
    "Registry Autostart & Scheduled Task Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Setup Wrapper)",
      "Browser Helper Extension (CRX / XPI)"
    ],
    "network_signatures": [
      "HTTP/HTTPS GET queries directing search traffic through affiliate tracking intermediate domains",
      "Periodic telemetry beacons transmitting host GUID and installation metrics"
    ],
    "evasion_techniques": [
      "Obfuscating installer components behind legitimate-looking software licensing dialogs",
      "Running watchdog processes to restore hijacked registry settings if modified"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "15c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3",
      "26d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\1ClickDownload",
      "HKCU\\Software\\1ClickDownload"
    ],
    "file_paths": [
      "%ProgramFiles%\\1ClickDownload\\1clickdown.exe",
      "%AppData%\\1ClickDownload\\config.json",
      "%LocalAppdata%\\Temp\\1click_setup.tmp"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender Antivirus",
    "Enforce administrative restrictions blocking unverified software installations",
    "Deploy secure web gateways to block domains known for distributing deceptive software wrappers"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - SoftwareBundler:Win32/1ClickDownload",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=SoftwareBundler:Win32/1ClickDownload"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - PUA.Win32.1ClickDownload",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "SoftwareBundler:Win32/1ClickDownload.A",
      "PUA:Win32/1ClickDownload.gen"
    ]
  },
  "motivation": "Advertising Monetization, PPI Affiliate Revenue & Telemetry Collection",
  "sample_hashes": []
}