{
  "family": "indiloadz",
  "sample_count": 146,
  "category": "pua",
  "description": "Adware:Win32/Indiloadz is a deceptive bundleware downloader that masquerades as a legitimate download manager, silently installing Potentially Unwanted Programs (PUPs) and browser hijackers alongside desired freeware.<br><br><b>What is Indiloadz?</b><br>To the average user, Indiloadz appears to be a helpful utility that facilitates the downloading of large files. For security analysts, it is a deceptive conduit for adware. It is specifically engineered to wrap legitimate software installers in a proprietary wrapper that injects secondary, unwanted payloads (like toolbars, optimizers, and crypto-miners) during the installation process.<br><br><b>Infection Vectors & Threat Hunting</b><br>Indiloadz is often encountered on third-party software hosting sites or fake torrent portals. When a user clicks a download link, they receive the Indiloadz executable instead of the requested software. Upon execution, the wrapper initiates a C2 connection to retrieve the latest list of affiliate adware. It uses Dark Patterns in its UI—pre-checked boxes and misleading 'Accept' buttons—to trick the user into authorizing the installation of the PUPs.<br><br><b>Forensic Analysis & Impact</b><br>Incident responders should look for anomalous HTTP/HTTPS traffic to known PPI (Pay-Per-Install) networks during software installations. EDR tools frequently flag Indiloadz due to its behavior of dropping multiple unassociated executables into the <code>%Temp%</code> directory and rapidly executing them. The ultimate impact is a severely bloated endpoint, reduced performance, and an expanded attack surface.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1112",
    "T1204.002",
    "T1189",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the ongoing downloading of secondary adware modules.",
    "Audit the 'Add/Remove Programs' list and uninstall the Indiloadz utility and any software installed at the exact same timestamp.",
    "Clear the Windows <code>%Temp%</code> directory, as Indiloadz uses this location to stage its malicious payloads.",
    "Utilize an enterprise anti-malware scan to ensure no high-severity threats were bundled with the adware."
  ],
  "what_to_avoid": [
    "Do not allow users to download software from third-party aggregators; enforce strict application whitelisting.",
    "Avoid treating Indiloadz as a simple annoyance; the affiliate networks it contacts are known to drop banking trojans."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}