{
  "family": "boilod",
  "sample_count": 55,
  "category": "adware",
  "description": "Boilod (cataloged under signatures including Adware:Win32/Boilod, Backdoor:MSIL/Boilod!pz, and PUA:Win32/Boilod) is an aggressive adware, browser hijacker, and riskware loader active since 2017. Bundled with third-party software downloaders and pirated utilities, Boilod installs persistent background services and scheduled tasks to inject unauthorized advertisements, banner overlays, and promotional search redirects into victim web browsers. Furthermore, hybrid MSIL variants include secondary backdoor functionality capable of checking in with remote telemetry endpoints and downloading additional adware bundles or monetization toolbars.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Boilod",
    "Backdoor:MSIL/Boilod!pz",
    "Adware.Win32.Boilod",
    "PUA:Win32/Boilod",
    "Win32/Boilod"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Boilod?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boilod is an aggressive adware and browser modifier that injects unwanted ads and redirects web browser searches."
      }
    },
    {
      "@type": "Question",
      "name": "How is Boilod distributed to users' computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled within freeware installers, deceptive software download managers, and cracked application packages."
      }
    },
    {
      "@type": "Question",
      "name": "Can Boilod function as a backdoor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, certain .NET MSIL variants contain backdoor functions allowing operators to push secondary software downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What modifications does Boilod make to web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser shortcuts, installs rogue extension helpers, and redirects search queries to affiliate portals."
      }
    },
    {
      "@type": "Question",
      "name": "How can Boilod be completely removed from a PC?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall unfamiliar programs from Control Panel, remove rogue extensions from browsers, and run a full antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Bundlers",
    "Pirated Software & Utility Cracks",
    "Pay-Per-Install Affiliate Networks"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Page Banner & Pop-Up Ad Injection",
    "Search Query Interception & Redirection",
    "Rogue Browser Extension Staging",
    "Background Telemetry Beaconing",
    "Secondary Software Download & Execution"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      ".NET MSIL Assembly",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET beacons querying affiliate syndication ad networks for promotional banners",
      "DNS queries to dynamic advertising redirection servers"
    ],
    "evasion_techniques": [
      "Disguising executables as legitimate software updater services",
      "Packaging within multi-stage commercial installer wrappers"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "726489312bcf8194ad9271649275819385920a19",
      "48b3b42f2b3e449a57291dc8f781bb49f8b15df7"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BoilodUpdater",
      "HKLM\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist\\boilod"
    ],
    "file_paths": [
      "%ProgramFiles%\\Boilod\\boilod.exe",
      "%AppData%\\Boilod\\update.vbs"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender",
    "Enforce enterprise browser extension whitelisting via Group Policy Objects (GPO)",
    "Educate users against downloading software from untrusted third-party download mirrors"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Boilod",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Boilod"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Backdoor:MSIL/Boilod!pz",
      "PUA:Win32/Boilod.A"
    ]
  },
  "motivation": "Financial Crime & Advertising Affiliate Fraud",
  "sample_hashes": []
}