{
  "family": "downloadadmin",
  "sample_count": 61,
  "category": "pua",
  "description": "DownloadAdmin (cataloged across antivirus vendors under detections including PUA:Win32/DownloadAdmin and Program:Win32/DownloadAdmin) is a deceptive software download manager and Potentially Unwanted Application (PUA) active since 2014. Distributed through third-party freeware hosting websites, DownloadAdmin wraps legitimate software installers with unwanted commercial bundles. During execution, it presents pre-checked promotional agreements, tricks users into installing secondary browser hijackers and adware extensions, and alters default browser homepages and search providers. DownloadAdmin configures background updater services, creates autostart entries under Windows CurrentVersion\\Run, and transmits host telemetry back to affiliate ad networks to optimize monetized payload delivery.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/DownloadAdmin",
    "Program:Win32/DownloadAdmin",
    "DownloadAdmin",
    "Win32/DownloadAdmin"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/DownloadAdmin?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DownloadAdmin is a potentially unwanted downloader that bundles adware and alters browser settings."
      }
    },
    {
      "@type": "Question",
      "name": "How does DownloadAdmin get onto user workstations?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through third-party download portals that wrap free software downloads in deceptive wrapper installers."
      }
    },
    {
      "@type": "Question",
      "name": "What unwanted software is installed by DownloadAdmin?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs browser hijackers, sponsored toolbars, coupon extensions, and affiliate adware."
      }
    },
    {
      "@type": "Question",
      "name": "How does DownloadAdmin maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds startup keys to the Windows registry and configures background updater services."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remove DownloadAdmin?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall unfamiliar software via Windows Settings, reset browser extensions and search settings, and run an AV scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1176",
    "T1112",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the initial installer executable to prevent further execution and secondary payload downloads.",
    "Audit the 'Add/Remove Programs' list and manually uninstall any unexpected applications that appeared concurrently with the Downloadadmin detection.",
    "Deploy an enterprise-grade adware removal tool (e.g., AdwCleaner) to locate and strip deep registry hooks, scheduled tasks, and forced browser policies.",
    "Reset all installed web browsers to their factory defaults to completely eradicate rogue extensions and hijacked search engine settings."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is clean simply because the AV quarantined the initial installer; the user may have already completed the installation.",
    "Avoid ignoring the infection; the tracking infrastructure actively harvests browsing habits, and the PPI network may pivot to delivering more severe threats."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Software Bundling Monetization & Ad Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Download Portals",
    "Third-Party Wrapper Installers",
    "Software Bundlers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Software Bundling Installation",
    "Browser Configuration Modification",
    "Browser Extension Injection",
    "Affiliate Telemetry Beaconing",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Windows Installer (.msi)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET requests downloading bundled software packages from affiliate servers",
      "Telemetry beacons reporting installed application lists"
    ],
    "evasion_techniques": [
      "Wrapping legitimate freeware utilities to disguise promotional payloads",
      "Concealing opt-out checkboxes in fine print"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DownloadAdmin",
      "%ProgramFiles%\\DownloadAdmin\\downloadadmin_svc.exe"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "Medium",
    "availability": "Low",
    "scope": "Browser hijacking, unwanted software bundling, system performance degradation"
  },
  "lineage": {
    "derived_from": [
      "Commercial PUA & Download Wrapper Frameworks"
    ],
    "variants": [
      "DownloadAdmin.A",
      "DownloadAdmin.Bundler"
    ]
  },
  "iocs": {
    "file_hashes": [
      "4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e",
      "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f"
    ],
    "delivery": [
      "download_manager_setup.exe",
      "installer_wrapper.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DownloadAdminService",
      "%ProgramData%\\DownloadAdmin\\downloadadmin.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - PUA:Win32/DownloadAdmin",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/DownloadAdmin"
    },
    {
      "name": "Huntress Threat Research - Analyzing Deceptive Software Bundlers",
      "url": "https://www.huntress.com/blog"
    }
  ]
}