Safebytes

Overview

SafeBytes (cataloged across security vendors as Rogue:Win32/SafeBytes, PUP.Optional.SafeBytes, and Program:Win32/SafeBytes) is a deceptive rogue PC optimizer and scareware family active since 2014. Distributed under commercial utility product names such as SafeBytes Total System Care and DriverAssist, the software utilizes high-pressure scaremongering tactics to deceive users into purchasing fraudulent software licenses. Once installed—often without explicit user consent via software bundling—SafeBytes initiates exaggerated or entirely fabricated system scans that report thousands of critical registry errors, security vulnerabilities, and driver corruptions. The application continuously interrupts user workflows with alarming warning banners and system tray notifications claiming imminent operating system failure. When users attempt to repair the fabricated issues, SafeBytes blocks remediation behind an expensive commercial paywall. Furthermore, SafeBytes establishes aggressive persistence through Registry Run keys and scheduled tasks, consuming significant system memory and background CPU cycles.

Known aliases

Threat reports may refer to this family under multiple names:

• Rogue:Win32/SafeBytes
• Program:Win32/SafeBytes
• PUP.Optional.SafeBytes
• Troj/SafeByte-A
• SafeBytes Total System Care
• DriverAssist

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Commercial Scareware Architecture · Rogue Pc Optimizer Engine

Known Derivatives & Downstream Variants: Safebytes Total System Care · Driverassist · Safebytes Anti-Malware

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• c3e5a7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5
• d4f6a8c0e2b4d6f8a0c2e4b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6

Delivery vectors

• Bundled installers alongside free utility software and media tools
• Deceptive system optimization landing pages and fake driver update popups

Persistence mechanisms

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\SafeBytes
• HKLM\SOFTWARE\SafeBytes\Total System Care
• %PROGRAMFILES%\SafeBytes\Total System Care\TotalSystemCare.exe

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_SAFEBYTES_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Safebytes"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "safebytes" ascii wide nocase
        $s2 = "rogue:win32/safebytes" ascii wide nocase
        $s3 = "program:win32/safebytes" ascii wide nocase
        $s4 = "pup.optional.safebytes" ascii wide nocase
        $s5 = "troj/safebyte-a" ascii wide nocase
        $s6 = "safebytes total system care" ascii wide nocase
        $s7 = "driverassist" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Safebytes (Rogueware) Execution & Triage
id: 27559808-435f-5bcd-bf95-e67cd7d2e46d
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Safebytes malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/safebytes
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.rogueware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1204_002
- attack.t1562_001
- attack.t1547_001
- attack.t1112
- attack.t1491_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_SAFEBYTES_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Safebytes tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "safebytes" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Terminate active SafeBytes processes (TotalSystemCare.exe, DriverAssist.exe) via Task Manager or administrative command prompt.
2. Uninstall SafeBytes Total System Care and associated companion utilities through Windows Programs and Features.
3. Remove persistent startup entries in HKCU\Software\Microsoft\Windows\CurrentVersion\Run and delete SafeBytes scheduled tasks.
4. Run a comprehensive antimalware scan to verify that no secondary adware or spyware payloads remain on the system.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not purchase a license or enter credit card information in response to SafeBytes scan warnings.
2. Avoid using third-party registry cleaner utilities that make unsubstantiated claims of system optimization.

References & External Analysis

• Microsoft Defender Security Intelligence - Rogue:Win32/SafeBytes
• Malwarebytes Labs Threat Intelligence - PUP.Optional.SafeBytes
• Search "safebytes" on VirusTotal (External Analysis)
• Search "safebytes" on Any.Run (Sandbox Sandbox)
• Search "safebytes" on MalwareBazaar (Malware Samples)

Frequently Asked Questions

Related Threats (Category: Rogueware)

Explore other documented threats in the same operational category:

• Auslogics
• Winwebsec
• Slimware
• Tweakbit

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/safebytes.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.