{
  "family": "installmonster",
  "sample_count": 16691,
  "category": "pua",
  "description": "InstallMonster is a pay-per-install (PPI) bundle installer family that wraps legitimate freeware with adware, browser hijackers, and potentially unwanted programs in exchange for affiliate revenue. While typically classified as PUA rather than outright malware, InstallMonster bundles can include credential-stealing components and aggressive ad injection. It typically arrives through deceptive download sites posing as official software distribution points. Removal often requires uninstalling multiple bundled components and resetting browser settings.",
  "cta": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.",
  "aliases": [
    "amonetize",
    "installcube"
  ],
  "enrichment_level": "hand-curated",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Installmonster?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "InstallMonster is a pay-per-install (PPI) bundle installer family that wraps legitimate freeware with adware, browser hijackers, and potentially unwanted programs in exchange for affiliate revenue. While typically classified as PUA rather than outright malware, InstallMonster bundles can include credential-stealing components and aggressive ad injection. It typically arrives through deceptive download sites posing as official software distribution points. Removal often requires uninstalling multiple bundled components and resetting browser settings."
      }
    },
    {
      "@type": "Question",
      "name": "How does Installmonster spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "InstallMonster (Amonetize) is a Russian-language bundler distributed primarily through pirated software and game-cheat downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What are the signs of an Installmonster infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bundled adware and PUAs installed without explicit consent, browser ads on clean sites, and PUA detections referencing InstallMonster, Amonetize, or InstallCube indicate its activity."
      }
    },
    {
      "@type": "Question",
      "name": "What should I do if I think I have Installmonster on my system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance."
      }
    }
  ],
  "faq_count": 4,
  "mitre_attack": [],
  "cisa_advisory": null,
  "last_updated": "2026-05-27"
}