{
  "family": "runbooster",
  "sample_count": 21,
  "category": "pua",
  "description": "RunBooster (cataloged under antimalware detections including PUA:Win32/RunBooster, Rogue:Win32/RunBooster, and PUP.Optional.RunBooster) is a deceptive rogue system optimizer and scareware potentially unwanted application. Masquerading as a high-performance Windows acceleration and registry cleaning tool, RunBooster is distributed through pay-per-install bundles, deceptive online banner ads claiming system degradation, and freeware download wrappers. Once installed, RunBooster conducts fabricated diagnostics that falsely report hundreds of critical system corruptions, registry anomalies, and memory errors. It relentlessly displays alarming warning dialogues and desktop pop-ups coercing users into purchasing a commercial license key to resolve the non-existent problems. RunBooster configures startup persistence via registry run keys and scheduled tasks, consuming system memory and CPU cycles while degrading overall workstation performance.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/RunBooster",
    "Rogue:Win32/RunBooster",
    "Adware:Win32/RunBooster",
    "PUP.Optional.RunBooster",
    "Program:Win32/RunBooster"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/RunBooster?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "RunBooster is a rogue system optimizer that fabricates system performance errors to coerce users into purchasing license keys."
      }
    },
    {
      "@type": "Question",
      "name": "How does RunBooster deceive computer users?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes fake diagnostic scans that intentionally exaggerate benign temporary files as critical registry errors."
      }
    },
    {
      "@type": "Question",
      "name": "How does RunBooster infiltrate Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with freeware downloads, deceptive online advertisements, and third-party software installers."
      }
    },
    {
      "@type": "Question",
      "name": "What impact does RunBooster have on system performance?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It runs persistent background processes that consume CPU and memory resources while generating disruptive pop-up alerts."
      }
    },
    {
      "@type": "Question",
      "name": "How can RunBooster be safely removed?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall via Windows Settings, remove scheduled updater tasks, clean startup registry keys, and run an antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1189",
    "T1491.001",
    "T1547.001",
    "T1053.005",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/RunBooster",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/RunBooster"
    },
    {
      "name": "Malwarebytes Labs - PUP.Optional.RunBooster Removal Guide",
      "url": "https://www.malwarebytes.com/blog/detections/pup-optional-runbooster"
    },
    {
      "name": "Sophos Threat Center - RunBooster Analysis",
      "url": "https://www.sophos.com/en-us/threat-center/threat-analyses"
    }
  ],
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1491.001",
      "name": "Defacement: Internal Defacement",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Advise the user not to input payment card details into the software purchase portal.",
    "Terminate RunBooster background processes via Windows Task Manager.",
    "Uninstall RunBooster via Windows Settings or Programs and Features.",
    "Remove associated scheduled tasks and registry keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Run a reputable antimalware scan to purge residual scareware files."
  ],
  "what_to_avoid": [
    "Do not purchase license keys or pay for unverified PC optimization software.",
    "Do not allow express installation modes in third-party freeware downloaders."
  ],
  "target_industries": [
    "Consumer Endpoints",
    "Small Business Workstations"
  ],
  "target_geographies": [
    "Global"
  ],
  "threat_actors": [
    "Scareware Affiliates & Commercial Software Bundlers"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "motivation": "Financial Fraud & Deceptive Commercial Monetization",
  "sample_hashes": [],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}