{
  "family": "4shared",
  "sample_count": 60,
  "category": "pua",
  "description": "4Shared (cataloged in antivirus vendor databases under detections including PUA:Win32/4Shared and Program:Win32/4Shared) represents bundled desktop client installers and companion toolbars associated with the 4shared file-hosting service. While providing access to cloud file sharing, historical versions of the installer were bundled with aggressive promotional adware, browser helper objects, and search hijackers. When executed, the installer modified system registry configurations, set default browser search engines to affiliate portals, and injected advertising banners into browsing sessions. Antivirus engines classify legacy 4Shared desktop installers as Potentially Unwanted Applications due to their invasive bundling behavior, undisclosed browser configuration changes, and tracking telemetry.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/4Shared",
    "Program:Win32/4Shared",
    "4SharedDesktop",
    "Win32/4Shared"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/4Shared?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "4Shared is a potentially unwanted software package that bundles promotional adware and alters browser settings."
      }
    },
    {
      "@type": "Question",
      "name": "Why do antivirus engines detect 4Shared desktop software as a PUA?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Legacy installer versions bundled search hijackers, toolbars, and adware without explicit user transparency."
      }
    },
    {
      "@type": "Question",
      "name": "What browser changes are made by 4Shared bundled software?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies default search engines, changes homepages, and installs sponsored browser helper objects."
      }
    },
    {
      "@type": "Question",
      "name": "Does 4Shared software establish persistent autostart services?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it creates autostart registry entries under CurrentVersion\\Run and registers background sync services."
      }
    },
    {
      "@type": "Question",
      "name": "How can users uninstall unwanted 4Shared components?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the application through Windows Settings, reset browser preferences, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1176",
    "T1112",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the initial 4shared 'download manager' executable to prevent the installation of further adware payloads.",
    "Audit the 'Add/Remove Programs' list and manually uninstall any unexpected applications that appeared concurrently with the adware detection.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and browser policies.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is clean simply because the AV quarantined the initial installer; the user may have already completed the installation.",
    "Avoid ignoring the infection; the tracking infrastructure actively harvests browsing habits, exposing corporate activities."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Software Monetization & Ad Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Bundled Desktop Client Installers",
    "Freeware Download Portals",
    "Sponsored Search Advertising"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Helper Object Installation",
    "Search Engine Redirection",
    "Promotional Ad Injections",
    "Background File Sync Service",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Windows Installer (.msi)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP search redirection through commercial monetization partner domains",
      "Telemetry check-ins reporting installed software versions"
    ],
    "evasion_techniques": [
      "Bundling with legitimate file-synchronization features to minimize user suspicion",
      "Valid commercial digital signature"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\4sharedDesktop",
      "%ProgramFiles%\\4shared Desktop\\4shared_desktop.exe"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "Low",
    "availability": "Low",
    "scope": "Browser search redirection, promotional pop-ups, system background memory consumption"
  },
  "lineage": {
    "derived_from": [
      "Commercial PUA & File-Sharing Bundlers"
    ],
    "variants": [
      "4Shared.Toolbar",
      "4Shared.Desktop"
    ]
  },
  "iocs": {
    "file_hashes": [
      "6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a",
      "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b"
    ],
    "delivery": [
      "4shared_desktop_setup.exe",
      "toolbar_installer.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\4Shared",
      "%AppData%\\4shared\\4shared_sync.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - PUA:Win32/4Shared",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/4Shared"
    },
    {
      "name": "Malwarebytes Labs Threat Encyclopedia - PUP.Optional.4Shared",
      "url": "https://www.malwarebytes.com"
    }
  ]
}