Monitoring unapproved apps/PUA/PUP/downware using default User Agents used by Installers

December 20, 2015 in Batch Analysis, Clustering, Forensic Analysis, Incident Response, Proxy Logs Analysis

While looking at the user agent list I shared today, I thought it might be an interesting idea to monitor unapproved/PUA/PUP/downware applications by paying attentions to all downloads that are leveraging the default user agents used by common installation packages, or the associated libraries (f.ex. inetc.dll used by Nullsoft packages).

Reviewing the list I came across a few low-hanging fruits:

  • AdvancedInstaller
  • Inno Setup Downloader
  • InnoTools_Downloader
  • InstallMaker
  • NSIS_Inetc (Mozilla)
  • NSIS_InetLoad (Mozilla)
  • NSIS_ToolkitOffers (Mozilla)
  • NSISDL/1.2 (Mozi
  • NSISDL/1.2 (Mozilla)
  • Setup Factory
  • Setup Factory 8.0
  • Setup Factory 9.0
  • TryMedia_DM_2.0.0

Monitoring these may not only help to discover people installing unapproved applications, PUA/PUPs/downware, but also potentially malware spreading using popular installers.

Obviously, many dodgy apps use dedicated/proprietary downloaders and it’s not difficult to change the default user agent, so there are still some gaps here, but I believe the value is there and this could become yet another alert helping to protect ‘open internet’ environments.

Comments are closed.