InstallCore

Posted: December 24, 2023

from Cybersecurity Glossary

Aliases:

IronSource Malware

Aliases:

Potentially Unwanted Program (PUP)

Platform:

Windows , MacOS

Variants:

Adware.InstallCore, PUA:Win32/InstallCore, PUP.Optional.InstallCore, PUA.Win32.Installcore, Application:W32/InstallCore, Adware.Win32.InstallCore.AA, MacOS:InstallCore-GG [PUP], Riskware/InstallCore

Risk Level:

Middle

InstallCore is a potentially unwanted software that deploys multiple applications on a user's computer, typically bundling a well-known program with one or more adware components. The creator of InstallCore is ironSource, a company specializing in the development of monetization, engagement, analytics, and discovery tools for app developers, device manufacturers, mobile carriers, and advertisers. This software is compatible with both Windows and Mac platforms.

Possible symptoms

Increased number of pop-up ads during browsing sessions.
Unwanted changes to browser settings and homepage.
Sluggish system performance, especially during startup.
Presence of unfamiliar programs or browser extensions.
Redirects to unfamiliar websites.
Unexplained consumption of network bandwidth.

Sources of the infection

Software Bundling. InstallCore often spreads through software bundling, where it is packaged with legitimate software downloads. Users may unknowingly install InstallCore along with the intended software.
Deceptive Download Websites. Users may encounter InstallCore on deceptive download websites that host misleading or fake download links. These websites trick users into downloading and installing the malware.
Pirated Software. Users downloading and installing pirated or cracked software may inadvertently install InstallCore. It is essential to obtain software from legitimate and authorized sources.

Overview

InstallCore, also known as IronSource Malware, is a potentially unwanted software created by ironSource, a company specializing in app development tools. This software operates on both Windows and MacOS platforms, deploying multiple applications on users' computers. It often bundles a popular program with one or more adware components, leading to a classification as a Potentially Unwanted Program (PUP).

Users may encounter InstallCore through various means, including software bundling, deceptive download websites, and the download of pirated software. The symptoms of an InstallCore infection include an increased number of pop-up ads, unwanted changes to browser settings, sluggish system performance, the presence of unfamiliar programs or extensions, redirects to unfamiliar websites, and unexplained consumption of network bandwidth.

If you suspect your system is infected with InstallCore, it is crucial to perform a thorough scan using reputable antivirus or anti-malware software. Remove detected InstallCore variants and associated files promptly. Additionally, review installed programs and browser extensions, uninstalling any unfamiliar or suspicious ones.

To prevent InstallCore infections, adopt safe browsing habits. Avoid downloading software from untrustworthy sources and only obtain programs from official websites. Keep your antivirus and anti-malware software up to date, regularly scanning your system for potential threats. Exercise caution when clicking on links or downloading attachments, especially from unknown or unverified sources.

🤔 What to do?

If you suspect your system is infected with InstallCore, perform a thorough scan using reputable antivirus or anti-malware software. Remove detected InstallCore variants and associated files immediately. Additionally, review installed programs and browser extensions, uninstalling any unfamiliar or suspicious ones.

🛡️ Prevention

To prevent InstallCore infections, practice safe browsing habits. Avoid downloading software from untrustworthy sources, and only obtain programs from official websites. Keep your antivirus and anti-malware software up to date, and regularly scan your system for potential threats. Exercise caution when clicking on links or downloading attachments, especially from unknown or unverified sources.