Adware.InstallCore

Short bio

Adware.InstallCore is Malwarebytes’ detection name for a family of bundlers that installs more than one application on the user’s computer, usually by combining a popular title with one or more adware programs.

The developer behind InstallCore is ironSource, a company that builds monetization, engagement, analytics, and discovery tools for app developers, device manufacturers, mobile carriers, and advertisers. InstallCore is available for Windows and Mac systems.

Type and source of infection

Adware.InstallCore are often served as updates for popular plug-ins like Java or Flash bundled with PUPs and adware.

Protection

Malwarebytes blocks Adware.InstallCore by using real-time protection.

Malwarebytes blocks Adware.InstallCore

Remediation

Malwarebytes can detect and remove Adware.InstallCore without further user interaction.

1. Please download Malwarebytes to your desktop.
2. Double-click MBSetup.exe and follow the prompts to install the program.
3. When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
4. Click on the Get started button.
5. Click Scan to start a Threat Scan.
6. Click Quarantine to remove the found threats.
7. Reboot the system if prompted to complete the removal process.

Traces/IOCs

Signed:

Dekifotulu Setup

Rosurarumo

Fecamohopa Setup

SHA256 hashes:

00BFD479C9DC87E0D34B831B67867300A3F7E0215F647C4DC2D5E2A17306D118

49C4914D242D92C12C6C7FA93449D3651C588A1F5CDEA27F6AF104687BC79328

E26DBFB22444C4566FE1BFEDB7630E375533C7060D51E70A1A28460C4FDD275C