{
  "family": "installerex",
  "sample_count": 43,
  "category": "adware",
  "description": "Installerex (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Installerex, SoftwareBundler:Win32/InstalleRex, and PUA:Win32/InstalleRex) is an aggressive software bundler and adware installer framework active since 2013. Disguised as legitimate freeware or open-source utility installers on third-party download mirrors and torrent portals, Installerex employs deceptive user interface patterns to trick users into accepting unwanted bundled programs. Upon execution, the wrapper silently drops and executes third-party browser hijackers, intrusive adware engines, and rogue toolbars. It establishes startup persistence, modifies default browser search engines to affiliate portals, and displays persistent pop-up advertisements to generate Pay-Per-Install (PPI) monetization for operators.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Installerex",
    "SoftwareBundler:Win32/InstalleRex",
    "PUA:Win32/InstalleRex",
    "Win32/Installerex",
    "Adware.Installerex"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Installerex?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Installerex is a software bundler and adware wrapper that installs unwanted browser hijackers and adware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Installerex trick users into installing adware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses deceptive dark patterns with pre-checked optional software agreements hidden in custom installation menus."
      }
    },
    {
      "@type": "Question",
      "name": "What browser changes are made by Installerex components?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It alters homepage URLs, redirects default search engines, and injects promotional banner ads into web browsing sessions."
      }
    },
    {
      "@type": "Question",
      "name": "Can Installerex download additional malware payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, certain bundler variants communicate with remote ad networks to download secondary affiliate applications."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove Installerex?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall unknown applications from Windows Settings, reset browser search defaults, and run a Microsoft Defender scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2013,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Download Portals",
    "Torrent & P2P File Sharing Sites",
    "Bundled Software Wrapper Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Silent Software Bundling",
    "Browser Search Engine Redirection",
    "Pop-Up & In-Page Ad Injection",
    "Registry Autostart Configuration",
    "Pay-Per-Install Affiliate Telemetry"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Setup Wrapper)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET beacons querying affiliate syndication servers for secondary bundle download URLs",
      "DNS requests routing browser search queries through affiliate intermediary portals"
    ],
    "evasion_techniques": [
      "Packaging malicious components within a functional, legitimate application setup routine",
      "Obfuscating internal configuration URLs using XOR encoding"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "1bb49f8b15df726489312bcf8194ad9271649275",
      "a19e48b3b42f2b3e449a57291dc8f781bb49f8b1"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\InstalleRexHelper"
    ],
    "file_paths": [
      "%ProgramFiles%\\InstalleRex\\bundle.exe",
      "%Temp%\\installerex_stage.exe"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Download software only from official developer websites rather than aggregator mirrors",
    "Audit installed browser extensions and search providers across managed corporate devices"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - SoftwareBundler:Win32/InstalleRex",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=SoftwareBundler:Win32/InstalleRex"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "SoftwareBundler:Win32/InstalleRex.A",
      "PUA:Win32/InstalleRex"
    ]
  },
  "motivation": "Financial Crime & Pay-Per-Install Software Bundling",
  "sample_hashes": []
}