Adanti

Category: advanced_threat · Aliases: Adware.Adanti, PUP.Adanti, Adanti Adware · Sample count (EMBER 2018): 1 · Enrichment: insufficient_information · Updated: 2026-07-01T16:00:59Z

Category: Advanced_ThreatActor: Unknown / CybercriminalIndustry: Global / OpportunisticMotivation: Opportunistic

Overview

Executive Summary

Adanti is an aggressive adware family designed to hijack web browsers and inject unsolicited advertisements into the user's browsing experience. It is engineered to generate continuous revenue through pay-per-click (PPC) and pay-per-view (PPV) affiliate schemes, often at the expense of system performance and user privacy.

Technical Details and Behavior

Adanti is typically distributed via deceptive software installers and fake system updates (e.g., fake Adobe Flash Player updates). Once it breaches a system, it installs malicious browser extensions and alters system-wide proxy settings to intercept and manipulate web traffic. The core functionality of Adanti revolves around its ability to analyze the content of the web pages a user is visiting and dynamically inject contextually relevant advertisements. This is achieved by executing heavily obfuscated JavaScript within the browser context. Adanti establishes persistence through Windows Services and scheduled tasks, ensuring that if the user attempts to remove the browser extension, the background service will simply reinstall it upon the next reboot.

Security Implications

The risk posed by Adanti extends beyond mere annoyance. By manipulating network traffic and executing arbitrary scripts within the browser, it creates a vulnerability that can be exploited for cross-site scripting (XSS) attacks or man-in-the-middle (MitM) surveillance. The adware's C2 communications also create unnecessary noise on the network, complicating incident response efforts.

Remediation and Eradication

Proxy Verification: Inspect and reset the Windows system proxy settings (Internet Options -> Connections -> LAN settings) to ensure traffic is not being maliciously routed.
Service Removal: Identify and disable any unauthorized Windows Services associated with Adanti using the Services snap-in (`services.msc`) or the command line (`sc delete`).
Enterprise Policies: Utilize Group Policy Objects (GPO) to prevent standard users from modifying critical browser settings or installing unapproved extensions.

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1566 T1543.003 T1176

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

T1566: Implement email filtering, Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and DMARC. Conduct user phishing awareness training.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ADANTI {
    meta:
        description = "Detects Adanti (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "adanti" ascii wide nocase
        $s2 = "adware.adanti" ascii wide nocase
        $s3 = "pup.adanti" ascii wide nocase
        $s4 = "adanti adware" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Adanti Activity
id: 64f35624af12aeb7d2b476ca50fc4c80
status: experimental
description: Detects generic indicators of the adanti malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*adanti*"
            - "*adware.adanti*"
            - "*pup.adanti*"
            - "*adanti adware*"
    condition: selection
level: medium

References & External Analysis

Search "adanti" on VirusTotal (External Analysis)

Frequently Asked Questions

How do I remove the Adanti Advanced_Threat from Windows?

Manual removal of Adanti is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Adanti a virus or a Advanced_Threat?

Adanti is classified as a Advanced_Threat. Unlike traditional viruses that infect files, modern malware like Adanti typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Adanti infection?

Symptoms of Adanti can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

Protect Your Network Against Advanced_Threats

Want to prevent Adanti and similar threats from compromising your organization? Read our comprehensive defensive guide: Suspect an Infection? What to do.

Need help with an active incident? Published by the SystemHelpdesk team.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/adanti.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.