Healthy Adware

Healthy Adware Description

Healthy by the HealthySoftware application has been classified as adware and a PUP. It is most likely being spread via questionable distribution tactics, such as software bundles or fake installers. Applications of this type aim to get installed without attracting the attention of the user. Healthy may be promoted by questionable websites that may try to convince users that the application provides relevant advice about achieving a healthier lifestyle. 

Once established on the device, adware applications will begin running an intrusive ad campaign that may result in a continuous stream of unwanted advertisements being displayed on the affected system. It should be noted that Healthy appears to be related to another similarly dubious program known as Strength by StrenghtTech.

Once fully established on the device, Healthy will place a new icon in the system's tray area. Clicking this icon will launch the default Web browser. However, instead of the normal homepage, the application will cause the browser to open the MSN Lifestyle site. At the same time, Healthy will generate various unwanted advertisements in other browser windows. Adware is typically responsible for showing untrustworthy advertisements that promote hoax websites, fake giveaways, platforms spreading additional PUPs, shady adult-oriented or age-restricted sites and more. 

The Healthy application also may modify the Registry of the device, as a way to establish persistence mechanisms. PUP often utilize such tactics to reinstate themselves after being partially removed. In addition, Healthy has been observed connecting to two IP addresses - 23[.]216[.]147[.]76 and 20[.]99[.]132[.]105 sporadically. This could be a sign that the application is transmitting data to its operators. PUPs are notorious for tracking users' browsing activities, collecting numerous device details, and in certain cases, extracting sensitive information (banking details, account credentials, payment information, credit/debit card numbers) from browsers' autofill data.