{
  "family": "asparnet",
  "sample_count": 58,
  "category": "trojan",
  "description": "Asparnet (cataloged across security vendors under detections including Trojan:Win32/Asparnet and Adware:Win32/Asparnet) is a persistent Windows adware and trojan downloader active since 2013. Infiltrating systems via software bundles, free utilities, and deceptive download prompts, Asparnet establishes residency to monetize web traffic and deliver secondary payloads. Once active, the malware installs helper services that monitor web browsing activity, inject pop-up advertisements into visited web pages, and redirect user search queries to sponsored landing portals. Asparnet creates startup keys under Windows CurrentVersion\\Run to maintain persistence and periodically queries remote command-and-control servers to download updated advertising configurations and secondary malware modules.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Asparnet",
    "Adware:Win32/Asparnet",
    "Win32/Asparnet",
    "Trojan.Asparnet"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Asparnet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Asparnet is a Windows adware and trojan downloader that injects pop-ups and downloads secondary malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Asparnet compromise systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through bundled freeware utilities, third-party download wrappers, and deceptive online advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "What modifications does Asparnet make to browser behavior?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects sponsored banner ads, creates pop-up windows, and redirects search traffic to affiliate websites."
      }
    },
    {
      "@type": "Question",
      "name": "How does Asparnet ensure persistence across reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds autostart values to the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How can users clean an Asparnet infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run an antimalware scan with Microsoft Defender, remove suspicious browser extensions, and delete startup registry keys."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1176",
    "T1112",
    "T1547.001",
    "T1105",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent Asparnet from downloading and executing its secondary payloads (e.g., ransomware).",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Asparnet persistence mechanisms.",
    "Review firewall and proxy logs to identify the C2 domains Asparnet attempted to contact, and block them enterprise-wide.",
    "Capture a live memory image (RAM dump) to extract the injected Asparnet modules and identify the secondary payloads."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Asparnet dropper was quarantined; always verify if secondary payloads were downloaded.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Advertising Revenue & Malware Staging",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Bundled Software Downloads",
    "Deceptive Ad Banners",
    "Freeware Download Managers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Page Ad Injection",
    "Search Query Redirection",
    "Secondary Payload Downloading",
    "Registry Autostart Persistence",
    "HTTP C2 Communication"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET requests fetching ad configuration files from remote IP addresses",
      "Search query redirection to affiliate monetization domains"
    ],
    "evasion_techniques": [
      "Bundling with legitimate applications to evade suspicion",
      "Dynamic runtime string decoding"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AsparnetService",
      "%AppData%\\Asparnet\\asparnet_host.exe"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "Medium",
    "availability": "Low",
    "scope": "Browser configuration tampering, unwanted pop-ups, system bandwidth consumption"
  },
  "lineage": {
    "derived_from": [
      "Win32 Adware & Trojan Downloader Architectures"
    ],
    "variants": [
      "Asparnet.A",
      "Asparnet.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c",
      "9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d"
    ],
    "delivery": [
      "utility_patch.exe",
      "asparnet_setup.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Asparnet",
      "%ProgramData%\\Asparnet\\asparnet.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Asparnet",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Asparnet"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.Asparnet",
      "url": "https://www.trendmicro.com"
    }
  ]
}