Daum

Overview

Adware:Win32/Daum is a classification for Potentially Unwanted Programs (PUPs) and adware heavily associated with South Korean distribution networks (often leveraging the name of the legitimate Daum web portal). It is primarily designed to hijack browser settings, forcing the default search engine and homepage to specific affiliate sites, and injecting intrusive advertisements into the user's browsing sessions to generate fraudulent revenue (`T1189`).

Understanding Daum (Adware/Hijacker)
To an end-user, Daum is highly disruptive. They will find their preferred search engine (like Google) replaced, and every search query will be redirected through tracking domains. For an IT department, Daum adware represents a frustrating loss of productivity and a potential vector for more severe malvertising attacks, particularly if the endpoint frequently visits Korean web properties.

Execution and Hijacking Mechanics
Daum adware is typically bundled with freeware or deceptive game installers targeting Asian markets. Upon execution, it establishes persistence via Registry Run keys or Scheduled Tasks (`T1547.001`). It then aggressively modifies the browser configuration files and registry settings (e.g., `Start Page`, `Search Page`) for Internet Explorer, Chrome, and Edge (`T1562.001`). Advanced variants may drop malicious Browser Helper Objects (BHOs) or extensions that continuously monitor and inject ads into web traffic.

Indicators of Compromise & Impact
The impact is a degraded user experience, loss of privacy, and potential exposure to further malware. Host-based IoCs include the presence of unexpected software in `%ProgramFiles%` (often with Korean language strings or metadata), unauthorized modifications to browser registry keys, and the forced installation of extensions. Network IoCs include web traffic constantly redirecting through specific tracking or affiliate URLs before reaching the intended destination.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DAUM {
    meta:
        description = "Detects Daum (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "daum" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Daum Activity
id: f0e73d11bdd3d3fc34ba9f31674ceece
status: experimental
description: Detects generic indicators of the daum malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*daum*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Use the standard Windows 'Programs and Features' applet to attempt uninstallation of the software.
2. Follow up with a robust Adware/PUP removal tool (like AdwCleaner) to eliminate lingering registry hooks and scheduled tasks.
3. Reset all installed web browsers to their factory defaults to completely clear out hijacked search settings and extensions.
4. Educate users about the risks of software bundling, especially when downloading freeware from international aggregation sites.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely on simply changing the homepage back in the browser settings; the adware's persistence mechanism will change it back upon reboot.
2. Avoid ignoring adware infections; the underlying affiliate networks they use are often compromised by threat actors.

References & External Analysis

• Search "daum" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Silentinstall
• Fakehack
• Multibar
• Teramind
• Downloadadmin

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/daum.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.