{
  "family": "youxun",
  "sample_count": 84,
  "category": "adware",
  "description": "Youxun (cataloged by security vendors as Adware:Win32/Youxun, PUA:Win32/Youxun, and Win32/Youxun) is an aggressive software monetization platform and smart downloader utility active since 2016. Originating primarily from Chinese freeware download portals and third-party software hubs (often packaged as '智能下载器.exe'), Youxun is bundled into free utilities, game patches, and media converters. Upon execution, Youxun connects to remote distribution servers to retrieve dynamic software installation manifests, silently downloading and installing multiple unwanted third-party applications, promotional helper toolbars, and rogue browser search extensions without clear user consent. Additionally, Youxun injects intrusive desktop pop-up advertisements, redirects web search queries to sponsored monetization portals, and beacons host hardware configurations and user browsing behavior to advertising telemetry servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Youxun",
    "PUA:Win32/Youxun",
    "Win32/Youxun"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Youxun?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Youxun is a Chinese software bundler and adware program that downloads unwanted applications and injects pop-up ads."
      }
    },
    {
      "@type": "Question",
      "name": "How does Youxun infiltrate Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads bundled inside free software downloads, game patches, and deceptive download manager wrappers."
      }
    },
    {
      "@type": "Question",
      "name": "What behavior does Youxun exhibit once installed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It connects to remote distribution servers to silently install secondary promotional software and display desktop advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "Does Youxun track user browsing information?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it collects search queries, visited URLs, IP addresses, and hardware telemetry to optimize advertising revenue."
      }
    },
    {
      "@type": "Question",
      "name": "How should users clean Youxun from their endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall unfamiliar programs from Control Panel, reset browser settings to default, and run an updated antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1189",
    "T1547.001",
    "T1176",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the initial installer executable to prevent further execution and secondary payload downloads.",
    "Audit the 'Add/Remove Programs' list and manually uninstall any unexpected applications that appeared concurrently with the Youxun detection.",
    "Deploy an enterprise-grade adware removal tool (e.g., AdwCleaner) to locate and strip deep registry hooks, scheduled tasks, and forced browser policies.",
    "Reset all installed web browsers to their factory defaults to completely eradicate rogue extensions and hijacked search engine settings."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is clean simply because the AV quarantined the initial installer; the user may have already completed the installation.",
    "Avoid ignoring the infection; the tracking infrastructure actively harvests browsing habits, and the PPI network may pivot to delivering more severe threats."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Adware Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Third-Party Software Bundlers",
    "Freeware Download Repositories",
    "Deceptive Installer Wrappers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Silent Software Bundling",
    "Ad Injection & Pop-ups",
    "Search Query Redirection",
    "Dynamic Manifest Downloading",
    "Hardware Telemetry Harvesting"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Browser Helper Object",
      "Extension"
    ],
    "network_signatures": [
      "HTTP GET requests fetching JSON installation manifests from ad servers",
      "Telemetry reporting host specifications and IP location"
    ],
    "evasion_techniques": [
      "Deceptive user interface with tiny uncheck boxes",
      "Silent command-line switches during payload installation"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\YouxunUpdater",
      "Scheduled Task triggering updater at startup"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "Medium",
    "availability": "Low",
    "scope": "Browser configuration integrity, desktop notification disruption, unapproved software installation"
  },
  "lineage": {
    "derived_from": [
      "Commercial Smart Downloaders"
    ],
    "variants": [
      "Youxun.A",
      "Youxun.Downloader"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c",
      "8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f"
    ],
    "delivery": [
      "youxun_setup.exe",
      "smart_downloader.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\YouxunService",
      "C:\\Users\\Public\\Youxun\\youxun_app.exe"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - PUA.Youxun",
      "url": "https://www.broadcom.com/support/security-center"
    },
    {
      "name": "Malwarebytes Labs Threat Encyclopedia - Adware.Youxun",
      "url": "https://www.malwarebytes.com/threats/youxun"
    }
  ]
}