{
  "family": "addrop",
  "sample_count": 103,
  "category": "adware",
  "description": "Addrop (cataloged across security vendors as Adware:Win32/Addrop, Adware.Addrop, and PUA:Win32/Addrop) is a persistent adware dropper and Potentially Unwanted Application (PUA) family active since 2014. Unlike simple downloaders that retrieve assets over the internet, Addrop packages multiple adware modules, browser hijackers, and tracking extensions compressed directly within its own executable stub. Distributed primarily through deceptive freeware installers, torrented software cracks, and fake media codec downloaders, Addrop executes silently in the background while displaying simulated setup progress dialogs. Once active, it extracts its payload of advertising frameworks into %ProgramFiles% and %AppData% directories. It modifies the Windows Registry to establish persistent autostart run keys, drops rogue extensions across Google Chrome, Mozilla Firefox, and Microsoft Edge to inject sponsored advertisements into visited websites, and alters DNS or HOSTS settings to redirect user search traffic to affiliate monetization networks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Addrop",
    "Adware.Addrop",
    "PUA:Win32/Addrop",
    "Trojan.Win32.Addrop"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Adware:Win32/Addrop threat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Addrop is an adware dropper that extracts embedded browser hijackers, toolbars, and advertising modules onto infected PCs."
      }
    },
    {
      "@type": "Question",
      "name": "How does Addrop differ from a trojan downloader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Addrop contains its secondary adware payloads compressed within its own binary, dropping them directly without needing network downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What modifications does Addrop make to web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs rogue extensions, modifies homepage and search provider configurations, and injects ad banners into visited pages."
      }
    },
    {
      "@type": "Question",
      "name": "How is Addrop typically delivered to user endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with cracked software, game modifications, torrent downloads, and fake media player setup files."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended procedure for removing Addrop?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run an antimalware scanner like Malwarebytes or Microsoft Defender, reset web browsers to default, and verify HOSTS file integrity."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1204.002",
    "T1176",
    "T1112",
    "T1562.001",
    "T1027.002",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Quarantine the initial dropper binary to prevent extraction of secondary advertising toolbars and extensions.",
    "Deploy specialized adware removal tools (e.g., Malwarebytes AdwCleaner) to purge deep registry keys and scheduled tasks.",
    "Reset all web browsers to default settings to remove rogue extensions, restore search engines, and clear tracking cookies.",
    "Audit the Windows HOSTS file (C:\\Windows\\System32\\drivers\\etc\\hosts) to ensure no security vendor domains are blocked."
  ],
  "what_to_avoid": [
    "Do not rely solely on Windows Add/Remove Programs, as adware uninstallers frequently execute scripts to redownload components.",
    "Avoid ignoring persistent adware infections, as tracking frameworks monitor user browsing behavior across sensitive portals."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Consumer Endpoints",
    "Commercial Workstations"
  ],
  "motivation": "Adware Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal",
    "Pay-Per-Install Syndicates"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "defense_evasion"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "lineage": {
    "derived_from": [
      "Deceptive Adware Bundlers"
    ],
    "variants": [
      "Addrop.A",
      "Addrop.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b",
      "8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c"
    ],
    "delivery": [
      "Fake software cracks, keygens, and torrent downloads",
      "Deceptive software update prompts on untrusted websites"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AddropService",
      "Rogue browser extension registrations in Chrome and Edge"
    ]
  },
  "sources": [
    {
      "name": "Malwarebytes Threat Intelligence - Adware.Addrop Detection",
      "url": "https://www.malwarebytes.com/blog/detections/adware-addrop"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Addrop",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Addrop"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}