Browshot

Overview

Trojan:Win32/Browshot (or BrowserHijack) acts as a highly aggressive Adware component or a secondary payload designed to completely subvert the victim's web browsing experience (`T1189`). While it may occasionally steal browsing history, its primary malicious function is monetizing the infection by forcibly redirecting web traffic, injecting advertisements, and manipulating search results to funnel traffic to attacker-controlled affiliate sites.

Understanding Browshot (Browser Hijacking)
To an end-user, the computer may feel normal, but their browser is broken: their homepage is changed, default search engines are replaced with obscure variants (like 'SearchProtect'), and intrusive ads appear on every site. For a SOC, a Browshot infection indicates that the user's endpoint defenses failed, often due to user execution of bundled 'freeware' or a successful drive-by download.

Execution and Persistence Mechanics
Browshot variants often bypass simple browser extensions. They achieve persistence by modifying the shortcut icons (`.lnk` files) on the desktop or taskbar, appending malicious URLs to the browser executable path (`T1547.009`). They also inject malicious DLLs into the browser process (Chrome, Edge, Firefox) itself (`T1055.001`), allowing them to intercept and rewrite HTTPS traffic *before* it is encrypted by the browser.

Indicators of Compromise & Impact
The impact is a severe loss of user productivity and the continuous risk of secondary infections via malvertising. Host-based IoCs include modified browser shortcut files, the presence of unknown, unsigned DLLs loaded into browser processes, and unauthorized modifications to the `HKCU\Software\Policies\Google\Chrome` registry keys (forcing enterprise policies on a home user). Network IoCs include a constant stream of background HTTP traffic to advertising trackers.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_BROWSHOT {
    meta:
        description = "Detects Browshot (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "browshot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Browshot Activity
id: a348ce57a35983115b3b2d39aac03f76
status: experimental
description: Detects generic indicators of the browshot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*browshot*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use dedicated anti-malware tools (like AdwCleaner) to scan for deeply embedded browser hooks and malicious registry policies.
2. Inspect and manually fix all browser shortcuts on the desktop, Start Menu, and Taskbar.
3. Perform a complete reset of all installed browsers to clear malicious extensions, search providers, and hijacked homepages.
4. Check for unauthorized Proxy configurations set in the Windows Internet Options.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely solely on uninstalling the 'freeware' that brought the hijacker; the adware components usually leave persistence mechanisms behind.
2. Avoid ignoring the alert; adware networks frequently pivot to serving ransomware if the host appears vulnerable.

References & External Analysis

• Search "browshot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Harvester
• Attack
• Genericrxcg
• Pcmega
• Adkdllwrapper

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/browshot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.