{
  "family": "rungbu",
  "sample_count": 40,
  "category": "adware",
  "description": "Rungbu (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Rungbu, PUA:Win32/Rungbu, and Adware.Rungbu) is an aggressive adware and Potentially Unwanted Application (PUA) family active since 2016. Spreading primarily through deceptive software bundlers, cracked video players, and unofficial download mirrors, Rungbu establishes persistence on target endpoints via scheduled tasks and registry run keys. Once running, Rungbu hooks browser components to display intrusive pop-up advertisements, inject sponsored banner ads into web pages, and redirect user search queries to affiliate marketing portals to monetize traffic.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Rungbu",
    "PUA:Win32/Rungbu",
    "Adware.Rungbu",
    "Win32/Rungbu",
    "Adware:Win32/Rungbu.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Rungbu?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rungbu is an aggressive adware family that injects unwanted pop-up ads and redirects search queries for profit."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rungbu infiltrate computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with free software, media players, and cracks downloaded from untrusted websites."
      }
    },
    {
      "@type": "Question",
      "name": "What changes does Rungbu make to web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser search parameters, installs unwanted browser extensions, and injects banners into webpages."
      }
    },
    {
      "@type": "Question",
      "name": "Does Rungbu track user activity?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it collects browsing telemetry, visited URLs, and search keywords to deliver targeted advertising."
      }
    },
    {
      "@type": "Question",
      "name": "How can users remove Rungbu completely?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall unfamiliar programs from Windows Settings, clean browser extensions, and run a Microsoft Defender scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Bundlers",
    "Software Cracks & Keygens",
    "Pay-Per-Install Download Managers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Page Banner Ad Injection",
    "Pop-Up Window Generation",
    "Search Engine Query Redirection",
    "Browsing History Telemetry",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET beacons querying remote ad delivery networks for injected banner scripts",
      "DNS queries to dynamic advertising redirect hosts"
    ],
    "evasion_techniques": [
      "Disguising binaries as media tools or software helper utilities",
      "Modifying browser configuration profiles rather than core system files"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "57291dc8f781bb49f8b15df726489312bcf8194a",
      "8194ad9271649275819385920a19e48b3b42f2b3"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\RungbuService"
    ],
    "file_paths": [
      "%ProgramFiles%\\Rungbu\\rungbu.exe",
      "%AppData%\\Rungbu\\helper.dll"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Enforce enterprise browser extension management policies via GPO",
    "Educate users against downloading software from untrusted third-party download mirrors"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Rungbu",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Rungbu"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Rungbu.A",
      "PUA:Win32/Rungbu!rfn"
    ]
  },
  "motivation": "Financial Crime & Pay-Per-Click Adware Syndication",
  "sample_hashes": []
}