{
  "family": "reimage",
  "sample_count": 23,
  "category": "rogue",
  "description": "Reimage (cataloged in antimalware telemetry under signatures including PUA:Win32/Reimage, Program:Win32/ReimageRepair, and Rogue:Win32/Reimage) is a prominent rogue system utility, aggressive scareware installer, and Potentially Unwanted Application (PUA) by Reimage Ltd active from 2012 to 2020. Aggressively distributed through deceptive software bundlers, intrusive redirect advertising networks, and fake 'virus detected' browser alerts, Reimage installs a system scan utility that systematically fabricates hundreds of critical operating system errors, stability warnings, and registry faults. It locks the victim into high-pressure scareware dialogs claiming system corruption is imminent, repeatedly demanding that the user purchase a high-cost commercial license key. Reimage registers autostart scheduled tasks, alters browser shortcuts, and actively resists simple uninstallation.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/Reimage",
    "Program:Win32/ReimageRepair",
    "Rogue:Win32/Reimage",
    "Win32/Reimage",
    "Reimage Repair",
    "PUA.Reimage"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/Reimage (Reimage Repair)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Reimage is a rogue system optimizer and scareware PUA that fabricates false computer errors to coerce victims into buying paid licenses."
      }
    },
    {
      "@type": "Question",
      "name": "Are the errors detected by Reimage Repair legitimate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. Reimage deliberately classifies benign registry entries and normal system files as critical errors to scare users."
      }
    },
    {
      "@type": "Question",
      "name": "How does Reimage get installed onto computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with third-party software installers, fake browser virus popups, and deceptive download manager wrappers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Reimage maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates scheduled tasks in Task Scheduler, adds autorun registry keys, and registers background watchdog services."
      }
    },
    {
      "@type": "Question",
      "name": "How do you remove Reimage Repair completely?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall it via Windows Programs and Features, delete its scheduled tasks, and run a full scan with Microsoft Defender Antivirus."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1204.002",
    "T1547.001",
    "T1059.003",
    "T1082",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Bundlers",
    "Fake Browser Virus Detected Popups",
    "Malvertising Search Redirection"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Vista",
    "Windows XP"
  ],
  "capabilities": [
    "Fabricated System Health & Error Reporting",
    "Scareware Coercion & Licensing Nag Screens",
    "Registry Autostart & Scheduled Task Persistence",
    "Host Hardware & Installation Telemetry Tracking",
    "Deceptive Commercial Payment Portal Redirection"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (GUI Application)",
      "Service Wrapper Binary"
    ],
    "network_signatures": [
      "HTTP/HTTPS GET requests transmitting installation telemetry and affiliate tracking IDs to vendor monetization servers",
      "Automated browser launching directing victims to commercial payment gateways"
    ],
    "evasion_techniques": [
      "Signing executables with commercial certificates to bypass basic SmartScreen warnings",
      "Disabling clean uninstallation by running background watchdog processes"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "9cb6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4",
      "adc7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ReimageRepair",
      "HKLM\\SOFTWARE\\Reimage"
    ],
    "file_paths": [
      "%ProgramFiles%\\Reimage\\ReimageRepair.exe",
      "%AppData%\\Reimage\\scan_results.xml",
      "%LocalAppdata%\\Temp\\reimage_setup.exe"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender",
    "Educate users against downloading software optimizers or trusting fake browser update alerts",
    "Enforce AppLocker policies restricting unauthorized executables from running in user appdata paths"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/Reimage",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/Reimage"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Rogue.Win32.Reimage",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "PUA:Win32/Reimage.A",
      "Program:Win32/ReimageRepair.gen"
    ]
  },
  "motivation": "Financial Fraud, Scareware Coercion & Licensing Fees",
  "sample_hashes": []
}