{
  "family": "vkontaktedj",
  "sample_count": 15,
  "category": "adware",
  "description": "VKontakteDJ (classified across antivirus vendors under designations including PUA:Win32/VKontakteDJ, Adware:Win32/VKontakteDJ, and Program:Win32/VKontakteDJ) is a Potentially Unwanted Application and media downloader adware bundled with third-party software installers targeting Russian and Eastern European users. While marketed as a utility for downloading audio and video tracks from VKontakte (VK), VKontakteDJ installs unwanted background components, alters web browser homepage and search engine settings, injects commercial advertisements into browsing sessions, and installs hidden background update services that establish persistent autostart entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run. The software collects user device information, browsing habits, and search telemetry to monetize advertising networks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/VKontakteDJ",
    "Adware:Win32/VKontakteDJ",
    "Program:Win32/VKontakteDJ",
    "VKontakteDJ Downloader",
    "Win32/VKontakteDJ"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/VKontakteDJ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "VKontakteDJ is a media downloader application classified as a Potentially Unwanted Application due to bundled adware and browser modifications."
      }
    },
    {
      "@type": "Question",
      "name": "How does VKontakteDJ alter web browser settings?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser start pages, default search engines, and shortcuts to force user navigation through monetized partner portals."
      }
    },
    {
      "@type": "Question",
      "name": "How does VKontakteDJ maintain persistence?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs background service executables, registers daily scheduled tasks, and creates registry Run keys."
      }
    },
    {
      "@type": "Question",
      "name": "What privacy concerns exist with VKontakteDJ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors user web search terms, browsing habits, and system telemetry, transmitting them to external advertising analytics servers."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove VKontakteDJ?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall VKontakteDJ via Windows Settings, reset browser homepages and search engines, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1547.001",
    "T1053.005",
    "T1112",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution: Browser Shortcut Modification",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to uninstall the primary Vkontaktedj application and any associated 'search protectors' or toolbars.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to strip the remaining Scheduled Tasks and registry hooks left behind by the uninstaller.",
    "Audit the properties of all browser shortcuts (`.lnk` files) on the user's Desktop and Taskbar to remove any appended malicious URLs.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; the software uses watchdog services to immediately re-apply the malicious settings.",
    "Avoid ignoring the infection; the affiliate networks powering these hijackers often serve malicious advertisements that can lead to severe malware infections."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/VKontakteDJ",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/VKontakteDJ"
    },
    {
      "name": "Kaspersky Threat Intelligence - PUA.Win32 Overview",
      "url": "https://threats.kaspersky.com/en/threat/not-a-virus:Downloader.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Browser Extensions (T1176)",
      "url": "https://attack.mitre.org/techniques/T1176/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}