{
  "family": "techsnab",
  "sample_count": 41,
  "category": "adware",
  "description": "Techsnab (cataloged across security vendors and threat intelligence databases under signatures including SoftwareBundler:Win32/Techsnab, Trojan:Win32/Techsnab, and PUA:Win32/Techsnab) is an aggressive software bundler, browser modifier, and adware framework active since 2016. Infiltrating endpoints primarily through third-party freeware download portals, deceptive installers, and torrent packages, Techsnab targets Chromium-based web browsers (such as Google Chrome and Microsoft Edge). Once active, the wrapper drops auxiliary executables (including chromelauncher.exe), modifies browser shortcuts and preferences, injects unwanted pop-up advertisements, and silently downloads additional Potentially Unwanted Programs (PUPs) to generate affiliate advertising revenue.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "SoftwareBundler:Win32/Techsnab",
    "Trojan:Win32/Techsnab",
    "PUA:Win32/Techsnab",
    "Win32/Techsnab",
    "Adware.Techsnab"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is SoftwareBundler:Win32/Techsnab?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Techsnab is an aggressive software bundler and adware installer that hijacks browser settings and injects ads."
      }
    },
    {
      "@type": "Question",
      "name": "What browser changes are made by Techsnab?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser startup shortcuts, alters default search engines, and installs chromelauncher.exe."
      }
    },
    {
      "@type": "Question",
      "name": "How does Techsnab infect Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled within freeware installers and third-party download managers using deceptive installation wizards."
      }
    },
    {
      "@type": "Question",
      "name": "Can Techsnab download secondary software?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it initiates background downloads of additional adware components, rogue extensions, and monetization utilities."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove Techsnab?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall unfamiliar programs from Windows Settings, restore clean browser shortcuts, and run a Microsoft Defender scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1547.001",
    "T1105",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "Software Cracks & Keygens",
    "Pay-Per-Install Download Managers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Chromium Browser Preference Modification",
    "Auxiliary Binary Staging (chromelauncher.exe)",
    "Pop-Up & In-Page Ad Injection",
    "Secondary Software Ingestion",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Setup Wrapper)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET beacons fetching ad injection scripts and secondary installer archives from remote servers",
      "DNS queries resolving affiliate redirect domains"
    ],
    "evasion_techniques": [
      "Modifying browser command-line shortcut arguments rather than editing core binary files",
      "Bundling inside legitimate, functional utilities to deceive users"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "48b3b42f2b3e449a57291dc8f781bb49f8b15df7",
      "726489312bcf8194ad9271649275819385920a19"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\TechsnabLauncher"
    ],
    "file_paths": [
      "%ProgramFiles%\\Techsnab\\chromelauncher.exe",
      "%AppData%\\Techsnab\\update.bin"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Audit and restore modified browser desktop shortcuts",
    "Block known adware syndication and download domains at enterprise gateways"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - SoftwareBundler:Win32/Techsnab",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=SoftwareBundler:Win32/Techsnab"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "SoftwareBundler:Win32/Techsnab.A",
      "Trojan:Win32/Techsnab!rfn"
    ]
  },
  "motivation": "Financial Crime & Pay-Per-Install Software Bundling",
  "sample_hashes": []
}