Whenu

Overview

Executive Summary

Distribution and Technical Behavior

• Contextual Ad Delivery: The core component of WhenU (SaveNow) actively monitored the URLs a user visited and the search terms they entered into search engines. If a user searched for "flights to London," WhenU would instantly generate a pop-up advertisement for a competing travel agency.
• Local Database and Updates: Rather than querying a server for every ad, WhenU downloaded a massive, encrypted database of keywords and corresponding affiliate links to the local hard drive. This allowed it to serve ads instantly without generating massive amounts of network traffic, hiding its operations from early firewalls.
• Deceptive EULA: WhenU was notorious for its End User License Agreement (EULA), which buried the details of its tracking and ad-serving behaviors deep within pages of legal jargon, allowing the company to claim users had "consented" to the adware.

Risk Assessment

Mitigation and Removal Strategies

• Endpoint Scanning: Modern enterprise-grade anti-malware solutions easily detect and remove WhenU and its associated components. A full system scan will identify the executables and the local ad databases.
• Application Control: The primary defense against adware like WhenU is enforcing strict application whitelisting policies, preventing standard users from executing unapproved software installers (especially P2P clients) that serve as the distribution vector.
• Legacy Systems: While WhenU is largely extinct on modern OS architectures, legacy systems (Windows XP/7) used in specific OT environments should be scanned to ensure these classic adware families are not silently consuming resources.

Known aliases

Threat reports may refer to this family under multiple names:

• Adware.WhenU
• PUP.SaveNow
• Adware.WhenUSave

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1112 T1566.002 T1176

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1566.002: Inspect email links for known malicious domains and use link-rewriting services for time-of-click analysis.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_WHENU {
    meta:
        description = "Detects Whenu (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "whenu" ascii wide nocase
        $s2 = "adware.whenu" ascii wide nocase
        $s3 = "pup.savenow" ascii wide nocase
        $s4 = "adware.whenusave" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Whenu Activity
id: e0eeca3a813c74145e0d1b7a1d6ac607
status: experimental
description: Detects generic indicators of the whenu malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*whenu*"
            - "*adware.whenu*"
            - "*pup.savenow*"
            - "*adware.whenusave*"
    condition: selection
level: medium

References & External Analysis

• Search "whenu" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Gt32Supportgeeks
• Rontokbr
• Toptools
• Installtoolbar
• Shandaadd

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/whenu.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.