{
  "family": "iobit",
  "sample_count": 18,
  "category": "pua",
  "description": "IOBit (classified across cybersecurity vendors under designations including PUA:Win32/IOBit, Program:Win32/IOBit, and Potentially Unwanted Application: IOBit) refers to a family of PC optimization, system maintenance, and driver updating software products (including Advanced SystemCare, IObit Driver Booster, and IObit Uninstaller) bundled with aggressive telemetry collectors and promotional adware components. Distributed via freeware bundle aggregators and deceptive online upgrade prompts, IOBit applications present exaggerated system registry errors, out-of-date driver risks, and fabricated performance bottlenecks to frighten users into purchasing premium software licenses. The software establishes numerous persistent Windows background services, scheduled tasks, and autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, frequently displaying intrusive pop-up advertisements, cross-promoting partner software utilities, and transmitting device telemetry to remote analytics infrastructure.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/IOBit",
    "Program:Win32/IOBit",
    "Win32/IOBit",
    "IOBit Advanced SystemCare",
    "PUA.IOBit"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/IOBit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "IOBit is a family of PC optimization and driver update utilities classified as Potentially Unwanted Applications due to aggressive scare tactics and bundled adware."
      }
    },
    {
      "@type": "Question",
      "name": "Why do antivirus programs flag IOBit products as PUA?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "They display exaggerated system error warnings, install persistent background services without clear disclosure, and push bundled promotions."
      }
    },
    {
      "@type": "Question",
      "name": "How does IOBit software get installed on computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with freeware downloads, deceptive driver update portals, and third-party software installers."
      }
    },
    {
      "@type": "Question",
      "name": "Does IOBit collect user telemetric data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it collects hardware specifications, installed software lists, and device identifiers, transmitting them to external analytics servers."
      }
    },
    {
      "@type": "Question",
      "name": "How can IOBit software be cleanly removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall all IOBit products via Windows Settings, remove associated scheduled tasks, and run a reputable antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.001",
    "T1053.005",
    "T1082",
    "T1071.001",
    "T1491.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2010,
  "threat_actor": null,
  "delivery_mechanism": [
    "Bundled Software Installers",
    "Deceptive Driver Update Websites",
    "Freeware Download Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Exaggerated System Error Display (Scare Tactics)",
    "Persistent Background Service & Task Scheduling",
    "Cross-Promotional Pop-up Ad Injection",
    "Hardware & Software Telemetry Collection",
    "Autostart Registry Run Key Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Windows Service Binary"
    ],
    "network_signatures": [
      "HTTP GET/POST traffic transmitting hardware profiles and license check requests to IObit servers",
      "Outbound connections retrieving dynamic promotional banner advertisements"
    ],
    "evasion_techniques": [
      "Installing multiple interdependent background services to hinder uninstallation",
      "Recreating scheduled tasks if terminated by standard task management tools"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b",
      "8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c"
    ],
    "registry_keys": [
      "HKCU\\Software\\IObit\\Advanced SystemCare",
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\AdvancedSystemCareService"
    ],
    "file_paths": [
      "%ProgramFiles%\\IObit\\Advanced SystemCare\\ASC.exe",
      "%ProgramFiles%\\IObit\\Driver Booster\\DriverBooster.exe"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) protection in Windows Defender Antivirus",
    "Configure group policies restricting execution of unapproved driver updating utilities",
    "Educate users to download software exclusively from official vendor repositories"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/IOBit",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/IOBit"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - PUA.Win32.IOBit",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "PUA:Win32/IOBit.A",
      "PUA:Win32/IOBit.DriverBooster"
    ]
  },
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "collection"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Deceptive Licensing Monetization & Telemetry Collection",
  "sample_hashes": []
}