{
  "family": "qqware",
  "sample_count": 14,
  "category": "advanced_threat",
  "description": "Adware:Win32/Qqware is a specific classification for adware and Potentially Unwanted Programs (PUAs) that heavily target users in the Asia-Pacific region, particularly those using software related to the Chinese tech giant Tencent (such as the QQ messaging app). It silently infiltrates endpoints to inject intrusive advertisements, hijack browser settings, and harvest user telemetry.<br><br><b>Understanding Qqware</b><br>To a user, Qqware often presents as a helpful add-on for Tencent QQ, such as a custom emoticon pack or a game booster. However, the true cost of this software is a severely degraded browsing experience. The user's homepage is altered, web pages are injected with excessive advertisements (often in Chinese), and browsing telemetry is harvested. For security analysts, this represents a regionalized Pay-Per-Install (PPI) monetization scheme targeting a specific user demographic.<br><br><b>Execution and Bundling Mechanics</b><br>Qqware is downloaded directly by users seeking QQ-related utilities (`T1189`). The primary installer executes and relies heavily on deceptive User Interface design. During installation, it silently authorizes the installation of multiple 'special offers' alongside the core utility. Once authorized, Qqware drops and installs rogue browser extensions (`T1176`) and frequently modifies browser shortcut files (`.lnk`) to append malicious tracking URLs (`T1546`). It establishes persistence using Scheduled Tasks (`T1053.005`) to monitor the browser configuration and reinstall the adware if the user attempts to remove it.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is a loss of productivity, potential exposure to malvertising, and privacy violations. EDR platforms will flag the initial installer executing scripts to modify browser preferences and create unauthorized Scheduled Tasks. Network logs will reveal anomalous routing of standard HTTP traffic through affiliate marketing networks and unexpected connections to Chinese IP space.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1176",
    "T1546",
    "T1189",
    "T1053.005",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1546",
      "name": "Event Triggered Execution: Browser Shortcut Modification",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to uninstall the primary Qqware application and any associated 'search protectors' or toolbars.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to strip the remaining Scheduled Tasks and registry hooks left behind by the uninstaller.",
    "Audit the properties of all browser shortcuts (`.lnk` files) on the user's Desktop and Taskbar to remove any appended malicious URLs.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; the software uses watchdog services to immediately re-apply the malicious settings.",
    "Avoid ignoring the infection; the affiliate networks powering these hijackers often serve malicious advertisements that can lead to severe malware infections."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}