Vigram

Overview

Adware/PUP:Win32/Vigram is a prevalent Potentially Unwanted Program (PUP) categorized as Adware. It is designed to monetize the user's web browsing activity without their explicit consent by forcefully injecting intrusive advertisements, pop-unders, and sponsored links directly into the webpages they visit. Vigram significantly degrades system performance and poses privacy risks by tracking browsing history.

Understanding Vigram (Adware)
To an end-user, Vigram is highly visible: web pages load slowly, words within articles are mysteriously hyperlinked to advertising sites, and unclosable pop-up ads appear constantly. For a security operations center (SOC), Vigram is an indicator of poor user hygiene and risky downloading behavior, serving as a potential gateway for more severe 'Drive-by Compromise' (`T1189`) attacks via malvertising.

Execution and Hijacking Mechanics
Vigram is typically distributed via deceptive software bundles (wrappers) on third-party freeware sites. Upon execution, it installs itself, often masquerading as a legitimate browser helper object (BHO) or extension (`T1176`). It intercepts HTTP/HTTPS traffic locally to inject its own ad scripts directly into the Document Object Model (DOM) of the webpage before the browser renders it. To ensure it remains active, Vigram establishes persistence via Scheduled Tasks (`T1053.005`) or Registry Run keys (`T1547.001`), frequently employing randomized file names to evade simple signature-based removal scripts.

Indicators of Compromise & Impact
The primary impact is a severe degradation of the user experience and exposure to potentially malicious ads. Host-based IoCs include EDR alerts for anomalous Scheduled Tasks launching browser processes or unknown executables from the `%AppData%` directory. Network IoCs include a massive increase in DNS queries and HTTP connections to known adware affiliate networks, tracking domains, and click-fraud infrastructure.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_VIGRAM {
    meta:
        description = "Detects Vigram (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "vigram" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Vigram Activity
id: 1076e0a86ebb3f449526b0a057904724
status: experimental
description: Detects generic indicators of the vigram malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*vigram*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Utilize the Windows 'Programs and Features' Control Panel to uninstall Vigram and any related software installed concurrently.
2. Meticulously review the Windows Task Scheduler; Vigram relies heavily on scheduled tasks to reinstall its browser extensions.
3. Reset all web browsers (Chrome, Edge, Firefox) to their default settings to remove the injected extensions and reset homepages.
4. Deploy an enterprise-grade PUP/Adware removal tool to locate and clean the randomized, hidden files and registry hooks.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow users to click on the advertisements generated by Vigram, as they frequently lead to tech support scams or malware.
2. Avoid trying to manually clean the registry without a specialized tool, as adware often uses complex, randomized keys.

References & External Analysis

• Search "vigram" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Passview
• Mirai
• Autoruns
• Spector
• Idlecrawler

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/vigram.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.