{
  "family": "cloudwrapper",
  "sample_count": 33,
  "category": "pua",
  "description": "CloudWrapper (cataloged across security vendors and threat intelligence databases as SoftwareBundler:Win32/CloudWrapper, PUA:Win32/CloudWrapper, and PUP.Optional.CloudWrapper) is a commercial software bundler, installer wrapper, and adware delivery framework active since 2016. Deployed by shady download portals to monetize third-party freeware, open-source utilities, and pirated software, CloudWrapper encapsulates legitimate installation binaries within a cloud-managed installation shell. When launched, the wrapper connects to remote cloud endpoints to retrieve real-time advertising campaigns, displaying multi-tiered offer screens with pre-selected installation checkboxes and misleading Accept workflows. It covertly installs secondary adware extensions, system cleaners, and sponsored search hijackers onto target endpoints before releasing the original requested software.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "SoftwareBundler:Win32/CloudWrapper",
    "PUA:Win32/CloudWrapper",
    "PUP.Optional.CloudWrapper",
    "Win32/CloudWrapper",
    "Adware.CloudWrapper"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is SoftwareBundler:Win32/CloudWrapper?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CloudWrapper is a software bundling wrapper that injects third-party adware, toolbars, and unwanted applications into legitimate software installers."
      }
    },
    {
      "@type": "Question",
      "name": "How does CloudWrapper fetch sponsored software offers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It queries remote cloud APIs at runtime to fetch geographically targeted adware offers and download URLs."
      }
    },
    {
      "@type": "Question",
      "name": "Why is CloudWrapper considered Potentially Unwanted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because it relies on deceptive opt-out buttons, pre-checked installation toggles, and covert distribution of unwanted software."
      }
    },
    {
      "@type": "Question",
      "name": "What risks are associated with software wrappers like CloudWrapper?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They expose systems to browser hijackers, system slowdowns, adware tracking, and potentially dangerous secondary payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How can I avoid downloading CloudWrapper installers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Always download applications from official developer domains and avoid third-party mirror portals that serve custom installer stubs."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1204.002",
    "T1185",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Web Download Mirrors",
    "Sponsored Search Engine Links",
    "Torrent Packaging Wrappers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Dynamic Cloud-Delivered Software Bundling",
    "Pre-Checked Deceptive Installation Interfaces",
    "Browser Search Hijacking",
    "Telemetry Reporting to Affiliate Servers",
    "Background Service Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (GUI Installer)",
      "Cloud Payload Stub"
    ],
    "network_signatures": [
      "HTTPS GET queries to cloud API endpoints requesting affiliate offer manifests based on client geolocation",
      "Telemetry pings reporting user click interactions and completed software bundle installations"
    ],
    "evasion_techniques": [
      "Staging bundled secondary payloads from high-reputation public cloud object storage (AWS S3, Google Cloud Storage)",
      "Valid code-signing certificates to minimize Windows SmartScreen reputation warnings"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6",
      "b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7"
    ],
    "registry_keys": [
      "HKCU\\Software\\CloudWrapper",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\CloudWrapper"
    ],
    "file_paths": [
      "%Temp%\\CloudWrapperSetup.exe",
      "%AppData%\\CloudWrapper\\installer.log",
      "%ProgramFiles%\\CloudWrapper\\helper.exe"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender",
    "Block unverified download aggregator portals using enterprise web filtering policies",
    "Educate users to recognize dark patterns in software setup wizards"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - SoftwareBundler:Win32/CloudWrapper",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=SoftwareBundler:Win32/CloudWrapper"
    },
    {
      "name": "Malwarebytes Threat Intelligence - PUP.Optional.CloudWrapper",
      "url": "https://www.malwarebytes.com"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "SoftwareBundler:Win32/CloudWrapper.A",
      "PUA:Win32/CloudWrapper.gen"
    ]
  },
  "motivation": "Pay-Per-Install Software Monetization & Cloud Adware Syndication",
  "sample_hashes": []
}