{
  "family": "pupstudio",
  "sample_count": 33,
  "category": "pua",
  "description": "PupStudio (cataloged across endpoint security vendors under signatures including PUA:Win32/PupStudio, SoftwareBundler:Win32/PupStudio, and PUP.Optional.PupStudio) is a commercial software bundler, installer monetization framework, and potentially unwanted application suite active since 2016. Developed to monetize free utility downloads, media converters, and system customization tools, PupStudio repackages legitimate software within a customized installer framework. During installation, PupStudio presents multi-screen promotional offers with pre-selected installation toggles and deceptive button phrasing designed to steer users into installing sponsored third-party software. The components installed by PupStudio include browser hijackers, intrusive adware extensions, fake PC optimizers, and background telemetry collection agents.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/PupStudio",
    "SoftwareBundler:Win32/PupStudio",
    "PUP.Optional.PupStudio",
    "Win32/PupStudio",
    "SoftwareBundler:Win32/PupStudio.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/PupStudio?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "PupStudio is a software bundler application that injects unwanted adware, browser hijackers, and system utilities into freeware installers."
      }
    },
    {
      "@type": "Question",
      "name": "How does PupStudio trick users into installing bundled software?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses dark patterns in the setup wizard, such as pre-checked opt-in boxes, misleading 'Next' buttons, and low-contrast disclaimer text."
      }
    },
    {
      "@type": "Question",
      "name": "What symptoms appear when PupStudio packages are installed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Browser homepage and default search modifications, unsolicited advertising banners, pop-up windows, and sluggish computer performance."
      }
    },
    {
      "@type": "Question",
      "name": "Why is PupStudio classified as a Potentially Unwanted Application?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because it installs third-party software without clear user awareness and collects background telemetry for monetization."
      }
    },
    {
      "@type": "Question",
      "name": "How can I remove PupStudio components from Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall unfamiliar programs via Windows Settings, reset browser search defaults, remove unknown browser extensions, and run a malware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1204.002",
    "T1185",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Third-Party Software Download Mirrors",
    "Sponsored Search Engine Ads",
    "Aggressive Landing Pages"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Third-Party Adware Bundling",
    "Pre-Checked Deceptive Installation Interfaces",
    "Browser Search Engine Overriding",
    "Telemetry Reporting to Affiliate Servers",
    "Registry Autostart & Service Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (GUI Installer)",
      "InnoSetup / NSIS Wrapper"
    ],
    "network_signatures": [
      "HTTP GET queries fetching affiliate offer manifests and dynamic download links based on host geolocation",
      "Telemetry pings reporting successful installation milestones to affiliate distribution networks"
    ],
    "evasion_techniques": [
      "Valid code-signing certificates to bypass Windows SmartScreen warnings",
      "Displaying offer disclaimers in faint, low-contrast text to reduce user opt-out rates"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4",
      "e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5"
    ],
    "registry_keys": [
      "HKCU\\Software\\PupStudio",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\PupStudio"
    ],
    "file_paths": [
      "%Temp%\\PupStudioSetup.exe",
      "%AppData%\\PupStudio\\installer.log",
      "%ProgramFiles%\\PupStudio\\agent.exe"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Train users to download software exclusively from official developer websites",
    "Use enterprise Group Policy to prevent standard user accounts from installing unapproved desktop software"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/PupStudio",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/PupStudio"
    },
    {
      "name": "Malwarebytes Threat Intelligence - PUP.Optional.PupStudio",
      "url": "https://www.malwarebytes.com"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "PUA:Win32/PupStudio.A",
      "SoftwareBundler:Win32/PupStudio.gen"
    ]
  },
  "motivation": "Deceptive Software Monetization & Pay-Per-Install Adware Syndication",
  "sample_hashes": []
}