{
  "family": "systemhealer",
  "sample_count": 28,
  "category": "ransomware",
  "description": "PUA:Win32/Systemhealer is a deceptive software program, commonly classified as scareware or a Fake PC Optimizer, which utilizes psychological manipulation and fraudulent system scans to extort money from users.<br><br><b>Understanding Systemhealer (Scareware)</b><br>To the end-user, a Systemhealer infection is alarming. Their screen is flooded with official-looking warnings claiming their computer is severely degraded, registry errors are present, or critical drivers are out of date. For security analysts, Systemhealer is a social engineering attack. The software itself is technically trivial; it does not actually optimize the PC or update drivers. Its sole purpose is to frighten the user into paying for a fake 'premium version' to fix the non-existent system issues.<br><br><b>Execution and Evasion Strategies</b><br>Systemhealer is typically distributed via malicious advertisements (malvertising), drive-by downloads, or bundled with pirated software. Upon execution, it aggressively modifies the user interface. It may add persistence via the Registry Run keys and scheduled tasks. It continuously displays fraudulent scanning progress bars and exaggerated error counts (`T1491`). The software is designed to be highly visible and difficult for a layperson to terminate or uninstall through standard Windows dialogs.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is financial loss if the user falls for the scam, and significant helpdesk ticket volume. Incident responders will observe a machine flooded with intrusive, fake UI elements. EDR logs will show the executable aggressively launching upon user logon. Unlike true ransomware, the files on the hard drive remain unencrypted and accessible if the fake UI can be bypassed.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1491",
    "T1562.001",
    "T1547.001",
    "T1189",
    "T1059.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1491",
      "name": "Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to prevent the Systemhealer software from communicating with its affiliate payment and tracking servers.",
    "Boot the infected machine into Safe Mode; this often bypasses the persistence mechanisms of trivial scareware, allowing for manual removal.",
    "Audit the 'Add/Remove Programs' list and manually uninstall the software, as well as any other unrecognized programs installed on the same date.",
    "If the user provided credit card information to the fake software, advise them to contact their bank immediately to dispute the fraudulent charges."
  ],
  "what_to_avoid": [
    "Do not pay the requested fee; the software is fraudulent and the 'premium' version provides no actual system optimization.",
    "Avoid assuming the machine is clean just because the pop-ups stopped; the underlying framework must be fully uninstalled."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}