{
  "family": "installcore",
  "sample_count": 1961,
  "category": "pua",
  "description": "InstallCore is a widely-distributed pay-per-install bundler classified as PUA that wraps free software with adware, browser hijackers, and additional bundled installers. It uses deceptive UI patterns during installation to trick users into accepting bundled components, and is one of the most prevalent PUA families globally. Removal often requires uninstalling multiple bundled components.",
  "cta": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.",
  "aliases": [
    "installerex"
  ],
  "enrichment_level": "hand-curated",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Installcore?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "InstallCore is a widely-distributed pay-per-install bundler classified as PUA that wraps free software with adware, browser hijackers, and additional bundled installers. It uses deceptive UI patterns during installation to trick users into accepting bundled components, and is one of the most prevalent PUA families globally. Removal often requires uninstalling multiple bundled components."
      }
    },
    {
      "@type": "Question",
      "name": "How does Installcore spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "InstallCore is a software bundling installer distributed via download portals and freeware sites, offering optional software during the install flow."
      }
    },
    {
      "@type": "Question",
      "name": "What are the signs of an Installcore infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Multiple unwanted programs installed alongside the desired software, browser homepage and search engine changes, and PUA detections for InstallCore or InstallerEx are typical."
      }
    },
    {
      "@type": "Question",
      "name": "What should I do if I think I have Installcore on my system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance."
      }
    }
  ],
  "faq_count": 4,
  "mitre_attack": [],
  "cisa_advisory": null,
  "last_updated": "2026-05-27"
}