{
  "family": "funshion",
  "sample_count": 32,
  "category": "adware",
  "description": "Funshion (classified across endpoint security engines under signatures including Adware:Win32/Funshion, PUA:Win32/Funshion, and PUP.Optional.Funshion) is a widely distributed Chinese peer-to-peer (P2P) streaming media client and software bundler developed by Beijing Funshion Online Technologies. Marketed as a media acceleration and streaming video application, Funshion bundled aggressive advertising software, third-party browser plugins, and monetized background download engines. Even when the media player is closed, Funshion leaves background service processes running that consume significant network bandwidth for P2P distribution, display pop-up and banner advertisements, alter default browser search preferences, and report endpoint telemetry to remote advertising syndication servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Funshion",
    "PUA:Win32/Funshion",
    "PUP.Optional.Funshion",
    "Win32/Funshion",
    "Funshion Media Player",
    "Adware:Win32/Funshion.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Funshion?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Funshion is a peer-to-peer media player software package that bundles intrusive adware, pop-up advertising, and persistent background P2P bandwidth consumers."
      }
    },
    {
      "@type": "Question",
      "name": "Why does Funshion run in the background after closing the app?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It maintains background P2P helper services that continue sharing local media chunks and consuming network bandwidth to support the vendor's distribution network."
      }
    },
    {
      "@type": "Question",
      "name": "What browser changes does Funshion implement?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It can install sponsored browser toolbars, alter default search providers to partner ad portals, and display pop-up advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How does Funshion get installed on computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is installed directly by users seeking online streaming content or silently bundled inside third-party free software download packages."
      }
    },
    {
      "@type": "Question",
      "name": "How can I completely remove Funshion from Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall Funshion via Windows Control Panel, terminate residual background P2P processes, remove startup registry entries, and scan with antimalware software."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.001",
    "T1185",
    "T1071.001",
    "T1082",
    "T1204.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2011,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "P2P Video Streaming Portals",
    "Third-Party Media Download Bundles"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Vista",
    "Windows XP"
  ],
  "capabilities": [
    "Persistent P2P Background Bandwidth Consumption",
    "Pop-up & System Tray Banner Ad Display",
    "Browser Homepage & Search Modification",
    "Hardware & Location Telemetry Reporting",
    "Windows Service Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (P2P Media Client)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "High-volume inbound and outbound UDP/TCP peer-to-peer streaming traffic on dynamic ports",
      "HTTP GET queries fetching multimedia advertising overlays and sponsored promotional banners"
    ],
    "evasion_techniques": [
      "Running persistent background P2P helper services that restart automatically upon termination",
      "Obfuscating uninstall entries in Windows Registry to hinder user removal"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "19b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8",
      "2a0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c"
    ],
    "registry_keys": [
      "HKLM\\SOFTWARE\\Funshion",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\FunshionService"
    ],
    "file_paths": [
      "%ProgramFiles%\\Funshion Online\\funshion.exe",
      "%ProgramFiles%\\Funshion Online\\FunshionService.exe",
      "%AppData%\\Funshion\\cache.dat"
    ]
  },
  "defensive_measures": [
    "Block peer-to-peer (P2P) streaming protocols at corporate firewalls and next-generation perimeter gateways",
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Defender",
    "Monitor network traffic for persistent high-volume upload bandwidth consumption from non-standard desktop services"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Funshion",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Funshion"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.Funshion",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Funshion.A",
      "PUA:Win32/Funshion.B"
    ]
  },
  "motivation": "P2P Bandwidth Sharing, Video Monetization & Adware Syndication",
  "sample_hashes": []
}