{
  "family": "downloadassistant",
  "sample_count": 26,
  "category": "adware",
  "description": "DownloadAssistant (classified across antimalware research telemetry under signatures including BrowserModifier:Win32/DownloadAssistant, Adware:Win32/DownloadAssistant, and PUA:Win32/DownloadAssistant) is an intrusive browser hijacker, adware toolbar, and search redirector active since 2013. Infiltrating Windows endpoints bundled with deceptive freeware utilities and download managers, DownloadAssistant modifies core browser configurations across Chrome, Firefox, and Internet Explorer. It locks the browser homepage and default search engine to partner search-arbitrage portals, injects unwanted commercial advertisements and inline hyperlinks into visited web pages, and intercepts search queries to display sponsored results. Additionally, DownloadAssistant installs background updater services and registry autoruns to resist manual uninstallation and continually harvest user browsing telemetry.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "BrowserModifier:Win32/DownloadAssistant",
    "Adware:Win32/DownloadAssistant",
    "PUA:Win32/DownloadAssistant",
    "Win32/DownloadAssistant",
    "DownloadAssistant Toolbar"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BrowserModifier:Win32/DownloadAssistant?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "DownloadAssistant is an intrusive browser hijacker and adware program that alters homepage and search settings to display ads."
      }
    },
    {
      "@type": "Question",
      "name": "How does DownloadAssistant infect computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with third-party software installers, free torrent download managers, and deceptive video converter setups."
      }
    },
    {
      "@type": "Question",
      "name": "What browser changes are made by DownloadAssistant?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It forces default search engine queries to partner arbitrage portals, changes homepages, and injects commercial advertising banners."
      }
    },
    {
      "@type": "Question",
      "name": "What information does DownloadAssistant collect?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It harvests user browsing history, search keywords, clicked advertising links, and basic hardware telemetry."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remove DownloadAssistant?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall the application via Windows Settings, reset browser configurations, and scan the system with Microsoft Defender Antivirus."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1059.007",
    "T1112",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Bundlers",
    "Freeware Download Managers",
    "Torrent File Repackagers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Homepage & Search Hijacking",
    "In-Page Commercial Ad & Hyperlink Injection",
    "Browser Extension & BHO Installation",
    "User Search & Browsing Telemetry Scraping",
    "Registry Autostart & Service Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Toolbar/Service)",
      "Browser Helper Object DLL"
    ],
    "network_signatures": [
      "HTTP GET requests redirecting search traffic through affiliate tracking intermediate domains",
      "Periodic telemetry beacons transmitting user search terms and visited domains"
    ],
    "evasion_techniques": [
      "Installing background watchdog services that restore hijacked browser settings if manually altered",
      "Modifying browser shortcut .lnk targets on the desktop to force navigation to partner portals"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9cb9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7",
      "adc0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DownloadAssistant",
      "HKLM\\SOFTWARE\\DownloadAssistant"
    ],
    "file_paths": [
      "%ProgramFiles%\\DownloadAssistant\\dlassist.exe",
      "%AppData%\\DownloadAssistant\\config.json",
      "%LocalAppdata%\\Temp\\dl_assistant_setup.tmp"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender",
    "Enforce administrative controls preventing non-administrators from modifying browser settings and installing extensions",
    "Inspect desktop .lnk shortcuts for unauthorized appended URL parameters"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - BrowserModifier:Win32/DownloadAssistant",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=BrowserModifier:Win32/DownloadAssistant"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.DownloadAssistant",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "BrowserModifier:Win32/DownloadAssistant.A",
      "Adware:Win32/DownloadAssistant.gen"
    ]
  },
  "motivation": "Advertising Monetization, Search Hijacking & Telemetry Collection",
  "sample_hashes": []
}