{
  "family": "xetapp",
  "sample_count": 27,
  "category": "adware",
  "description": "Xetapp (cataloged across security intelligence feeds under signatures including Adware:Win32/Xetapp, PUA:Win32/Xetapp, and SoftwareBundler:Win32/Xetapp) is an intrusive adware framework and potentially unwanted application (PUA) active since 2015. Distributed primarily through deceptive free software repackagers, fake video player updates, and torrent installers, Xetapp covertly embeds itself into endpoint systems during third-party installations. Once active, Xetapp alters browser configuration files, installs unauthorized background helper extensions in Chrome and Firefox, and modifies desktop shortcut targets to append affiliate tracking tags. It forcefully injects floating advertisement banners into visited web pages, hijacks default search engine results to partner advertising portals, and collects detailed browsing telemetry, wasting bandwidth and severely degrading user experience.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Xetapp",
    "PUA:Win32/Xetapp",
    "SoftwareBundler:Win32/Xetapp",
    "Win32/Xetapp",
    "Adware.Xetapp"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Xetapp?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Xetapp is an adware program that injects unauthorized web advertisements and redirects search engine queries to generate revenue."
      }
    },
    {
      "@type": "Question",
      "name": "How does Xetapp get onto computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled inside third-party free software installers, cracked software setups, and deceptive video player downloaders."
      }
    },
    {
      "@type": "Question",
      "name": "How does Xetapp manipulate web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs unwanted browser extensions, changes default search engines, and modifies browser desktop shortcuts to append tracking URLs."
      }
    },
    {
      "@type": "Question",
      "name": "What user information is tracked by Xetapp?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors web browsing patterns, search queries, visited domains, and basic hardware system telemetry."
      }
    },
    {
      "@type": "Question",
      "name": "How do you remove Xetapp completely?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall rogue programs via Windows Settings, reset browser configurations, clean desktop shortcut targets, and run a scan with Microsoft Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1059.007",
    "T1112",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Bundlers",
    "Fake Media Codec Installers",
    "Torrent Download Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Page Floating Advertisement Injection",
    "Search Engine Query Redirection",
    "Browser Helper Extension Installation",
    "Desktop Shortcut Target Manipulation (.lnk)",
    "User Browsing Telemetry Harvesting"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Bundler Wrapper)",
      "Browser Extension Script (JS/JSON)"
    ],
    "network_signatures": [
      "HTTP/HTTPS GET queries directing search traffic through affiliate tracking redirect domains",
      "Outbound telemetry beacons transmitting user search terms and domain visits"
    ],
    "evasion_techniques": [
      "App-pending tracking arguments to legitimate browser shortcut targets to evade extension inspection",
      "Running background watchdog services that restore extensions if manually deleted"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7af1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9",
      "8ba2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\XetappService",
      "HKCU\\Software\\Xetapp"
    ],
    "file_paths": [
      "%ProgramFiles%\\Xetapp\\xetapp.exe",
      "%AppData%\\Xetapp\\config.ini",
      "%LocalAppdata%\\Temp\\xet_wrap.tmp"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender Antivirus",
    "Inspect desktop .lnk shortcuts for unauthorized appended URL parameters",
    "Block unprivileged users from installing unauthorized browser extensions via Group Policy"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Xetapp",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Xetapp"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.Xetapp",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Xetapp.A",
      "PUA:Win32/Xetapp.gen"
    ]
  },
  "motivation": "Advertising Monetization, Click-Through Revenue & Telemetry Harvesting",
  "sample_hashes": []
}