{
  "family": "mucc",
  "sample_count": 42,
  "category": "adware",
  "description": "Mucc (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Mucc, PUA:Win32/Mucc, and Adware.Mucc) is an aggressive adware and Potentially Unwanted Application (PUA) family active since 2016. Infiltrating endpoints primarily through third-party freeware download portals, deceptive game installers, and fake codec packages, Mucc installs persistent background processes and browser helper components. Once active, the adware injects unsolicited pop-up advertisements, overlays intrusive banners on legitimate web pages, and redirects user search queries through affiliate marketing networks to generate fraudulent click revenue.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Mucc",
    "PUA:Win32/Mucc",
    "Adware.Mucc",
    "Win32/Mucc",
    "Adware:Win32/Mucc.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Mucc?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mucc is an adware and PUA family that injects pop-ups and banner advertisements into web browsers without consent."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mucc get installed on a computer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is typically bundled with free third-party software, utilities, or cracked games downloaded from unofficial sites."
      }
    },
    {
      "@type": "Question",
      "name": "What privacy concerns are associated with Mucc?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It tracks user browsing habits and search queries to display targeted affiliate promotional ads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Mucc affect PC performance?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It consumes system memory, slows down browser navigation, and causes intrusive pop-up windows."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove Mucc?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall unfamiliar programs from Windows Settings, clean browser extensions, and run a scan with Microsoft Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "Software Cracks & Keygens",
    "Pay-Per-Install Download Managers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Page Banner Ad Injection",
    "Pop-Up Window Display",
    "Search Query Redirection",
    "Browsing History Telemetry",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET beacons querying remote ad syndication servers for injection scripts",
      "DNS queries to dynamic advertising redirect hosts"
    ],
    "evasion_techniques": [
      "Disguising binaries as media tools or software helper utilities",
      "Modifying browser configuration profiles rather than core system files"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "5df726489312bcf8194ad9271649275819385920",
      "2b3e449a57291dc8f781bb49f8b15df726489312"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\MuccUpdater"
    ],
    "file_paths": [
      "%ProgramFiles%\\Mucc\\mucc.exe",
      "%AppData%\\Mucc\\helper.dll"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Enforce enterprise browser extension management policies via GPO",
    "Educate users against downloading software from untrusted third-party download portals"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Mucc",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Mucc"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Mucc.A",
      "PUA:Win32/Mucc!rfn"
    ]
  },
  "motivation": "Financial Crime & Pay-Per-Click Adware Syndication",
  "sample_hashes": []
}