{
  "family": "opendownloadmanager",
  "sample_count": 13,
  "category": "adware",
  "description": "OpenDownloadManager (classified across endpoint security engines as PUA:Win32/OpenDownloadManager and Adware:Win32/OpenDownloadManager) is a Potentially Unwanted Application and download manager bundled with invasive advertising injectors. Promoted as a utility to accelerate web file downloads, OpenDownloadManager injects commercial affiliate advertisements, pop-under windows, and sponsored search results into web browsing sessions. It alters browser default search engines and new tab URLs across installed browsers, routes search queries through monetized third-party search syndicates, and establishes persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/OpenDownloadManager",
    "Adware:Win32/OpenDownloadManager",
    "Program:Win32/OpenDownloadManager",
    "OpenDownloadManager Adware",
    "Win32/OpenDownloadManager"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/OpenDownloadManager?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "OpenDownloadManager is an adware and download manager application that hijacks browser settings and injects sponsored ads."
      }
    },
    {
      "@type": "Question",
      "name": "How does OpenDownloadManager alter web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser start pages, default search engines, and shortcuts to force user navigation through monetized partner portals."
      }
    },
    {
      "@type": "Question",
      "name": "How does OpenDownloadManager get installed on PCs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled into freeware downloaders, media converters, and deceptive online software installation wizards."
      }
    },
    {
      "@type": "Question",
      "name": "How does OpenDownloadManager maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It adds autostart values to Windows Run registry keys and registers background scheduled tasks."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove OpenDownloadManager?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall OpenDownloadManager via Windows Settings, reset browser homepages and search engines, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.004",
      "name": "Command and Scripting Interpreter: Unix Shell (or Windows CMD/Batch)",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to systematically identify and uninstall all recently added programs, focusing on toolbars and 'search protectors'.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to strip the deeply embedded Scheduled Tasks and registry hooks left behind by the adware framework.",
    "Force a complete reset of all installed web browsers (Chrome, Edge, Firefox) to factory defaults to eradicate rogue extensions and restore the homepage.",
    "Quarantine the original installer file to prevent further execution."
  ],
  "what_to_avoid": [
    "Do not rely solely on manual uninstallation via the Control Panel; the payloads frequently use watchdog services to immediately reinstall themselves.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or provide a foothold for more severe malvertising attacks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/OpenDownloadManager",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/OpenDownloadManager"
    },
    {
      "name": "Malwarebytes Labs - PUP.Optional.OpenDownloadManager Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/pup-optional-opendownloadmanager"
    },
    {
      "name": "MITRE ATT&CK - Browser Extensions (T1176)",
      "url": "https://attack.mitre.org/techniques/T1176/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}