{
  "family": "bundleloader",
  "sample_count": 2,
  "category": "trojan",
  "description": "TrojanDownloader:Win32/Bundleloader is a classification for a vast ecosystem of software 'wrappers' and deceptive installers whose primary business model is the aggressive distribution of Potentially Unwanted Programs (PUPs), Adware, and sometimes full-fledged malware. These loaders monetize free software distribution by tricking users into installing additional, unwanted payloads during the installation process (`T1189`).<br><br><b>Understanding Bundleloader (PUP Distribution Networks)</b><br>To an end-user, Bundleloader looks like the legitimate installer for a free utility (e.g., a PDF converter, a media player, or a game cheat) downloaded from a third-party software portal. For a security team, it represents a significant failure in endpoint hygiene and a vector for 'nuisance' threats that drain IT resources. The loader itself is not the payload; it is the delivery mechanism for adware like Zugo or rogue optimizers like PC Optimizer Pro.<br><br><b>Execution and Deception Mechanics</b><br>Bundleloaders rely entirely on deceptive UI/UX design (Dark Patterns). When executed, the installer presents multiple screens. Mixed in with the legitimate Terms of Service are pre-checked boxes or confusingly worded 'Accept' buttons that grant permission to install bundled offers (`T1566.002`). If the user clicks 'Next' without reading carefully, the loader silently connects to an affiliate tracking network (`T1105`), downloads the PUP payloads into the `%Temp%` directory, and executes them silently alongside the desired software.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the sudden appearance of multiple unwanted applications, browser hijackers, and severe system sluggishness. Host-based IoCs include the creation of multiple unrelated executables in the `%Temp%` directory during the installation of a single program. EDR alerts often flag the original installer process for dropping and executing numerous child processes. Network IoCs include the installer making HTTP POST requests to known affiliate tracking domains (like InstallMonetizer or OpenCandy) to log the successful installation for payout.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.002",
    "T1189",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Distribution via third-party software portals)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1566.002",
      "name": "Phishing: Spearphishing Link (Social engineering via deceptive installer UI)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the bundled adware/PUPs)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Use the Windows 'Programs and Features' Control Panel to meticulously review and uninstall all software installed on the date of the incident.",
    "Run a deep scan with a reputable enterprise Adware/PUP removal tool, as these bundles often leave persistent registry hooks.",
    "Reset all web browsers to default settings, as Bundleloaders frequently drop browser hijackers.",
    "Implement Application Control (e.g., AppLocker) to block execution from the `%Temp%` and `%Downloads%` directories for standard users."
  ],
  "what_to_avoid": [
    "Do not allow users to download software from unverified third-party aggregation sites (e.g., CNET Download, Softonic).",
    "Avoid quickly clicking 'Next' through freeware installers; always select the 'Custom' or 'Advanced' installation option to uncheck bundles."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}