{
  "family": "kuaiba",
  "sample_count": 53,
  "category": "adware",
  "description": "Kuaiba (cataloged across antivirus vendors under signatures including Adware:Win32/Kuaiba, PUA:Win32/Kuaiba, and Program:Win32/Kuaiba) is a deceptive game distribution client and aggressive adware framework originating in China and active since 2013. Marketed as a fast game downloader and launcher utility, Kuaiba surreptitiously modifies host desktop environments and network configurations. Upon execution, Kuaiba creates autostart registry entries under CurrentVersion\\Run, alters default web browser search engines, modifies browser desktop shortcut targets by appending monetization query parameters, and schedules recurring background maintenance tasks. The software downloads and displays unsolicited game advertisements, promotional pop-up dialogues, and affiliate software installers without explicit user consent, degrading operating system performance and transmitting telemetry regarding installed gaming software to remote analytics endpoints.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Kuaiba",
    "PUA:Win32/Kuaiba",
    "Program:Win32/Kuaiba",
    "Kuaiba Game Box"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Kuaiba?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Kuaiba is an aggressive adware and software bundler that displays game advertisements and alters browser shortcuts."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kuaiba monetize infected computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects promotional pop-ups, redirects search queries, and downloads affiliated game software."
      }
    },
    {
      "@type": "Question",
      "name": "What changes does Kuaiba make to desktop browser shortcuts?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies .lnk shortcut target parameters to append affiliate URLs, loading promotional sites upon launch."
      }
    },
    {
      "@type": "Question",
      "name": "How does Kuaiba maintain startup persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes autostart entries under Windows CurrentVersion\\Run and creates recurring scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove Kuaiba?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall Kuaiba via Windows Settings, repair browser shortcut files, remove scheduled tasks, and scan with antimalware."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Kuaiba frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Advertising Revenue & Game Promotion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Third-Party Game Downloader Wrappers",
    "Affiliate Freeware Portals",
    "Deceptive Pop-Up Install Prompts"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Unsolicited Pop-Up Ad Display",
    "Browser Desktop Shortcut Hijacking",
    "Scheduled Task Monetization",
    "Gaming Software Telemetry Collection",
    "Silent Secondary Game Dropping"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons reporting system hardware metrics and installed games to Chinese analytics servers",
      "HTTP GET requests downloading advertising banners and pop-up game assets"
    ],
    "evasion_techniques": [
      "Obfuscated installer packages with hidden opt-out checkboxes",
      "Modifying shortcut target arguments instead of browser binaries",
      "Background task execution to bypass user inspection"
    ],
    "indicators": {
      "file_paths": [
        "C:\\Program Files\\Kuaiba\\kuaiba_client.exe",
        "%AppData%\\Kuaiba\\ad_helper.exe"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\KuaibaLauncher"
      ]
    }
  },
  "severity": "medium",
  "lineage": {
    "derived_from": [
      "Kuaiba Game Platform"
    ],
    "variants": [
      "Kuaiba.Adware",
      "Kuaiba.Gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7890123456789abcdef0123456789abcdef0123456789abcdef0123456789abc",
      "890123456789abcdef0123456789abcdef0123456789abcdef0123456789abcd"
    ],
    "delivery": [
      "kuaiba_game_box_setup.exe",
      "game_accelerator_installer.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\KuaibaLauncher"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Adware:Win32/Kuaiba",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Kuaiba"
    },
    {
      "name": "Threat Intelligence Reference - PUA:Win32/Kuaiba",
      "url": "https://www.virustotal.com/gui/file-analysis"
    }
  ]
}