Installcore

Category: pua · Aliases: installerex · Sample count (EMBER 2018): 1,961 · Enrichment: hand-curated · Updated: 2026-05-27

Overview

InstallCore is a widely-distributed pay-per-install bundler classified as PUA that wraps free software with adware, browser hijackers, and additional bundled installers. It uses deceptive UI patterns during installation to trick users into accepting bundled components, and is one of the most prevalent PUA families globally. Removal often requires uninstalling multiple bundled components.

Frequently Asked Questions

What is Installcore?

InstallCore is a widely-distributed pay-per-install bundler classified as PUA that wraps free software with adware, browser hijackers, and additional bundled installers. It uses deceptive UI patterns during installation to trick users into accepting bundled components, and is one of the most prevalent PUA families globally. Removal often requires uninstalling multiple bundled components.

How does Installcore spread?

InstallCore is a software bundling installer distributed via download portals and freeware sites, offering optional software during the install flow.

What are the signs of an Installcore infection?

Multiple unwanted programs installed alongside the desired software, browser homepage and search engine changes, and PUA detections for InstallCore or InstallerEx are typical.

What should I do if I think I have Installcore on my system?

If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.

Need help with an active incident? If you suspect this malware on your system, do not attempt manual removal. Contact SystemHelpdesk expert MSP support at 855-783-7555 for professional incident response guidance.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/installcore.json

About this catalog

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families extracted from the EMBER 2018 benchmark. The catalog is also published on Hugging Face and Kaggle.