{
  "family": "systemhealer",
  "sample_count": 28,
  "category": "rogue",
  "description": "SystemHealer (classified across antimalware research telemetry under signatures including PUA:Win32/SystemHealer, Program:Win32/SystemHealer, and Rogue:Win32/SystemHealer) is a deceptive rogue system utility and Potentially Unwanted Application (PUA) active since 2015. Distributed through deceptive software bundlers, fake update popups, and intrusive malvertising networks, SystemHealer presents itself as an all-in-one Windows registry and performance optimization tool. Once installed, it performs fabricated system scans, displaying hundreds of exaggerated or fictitious 'critical errors', 'registry corruptions', and 'security vulnerabilities'. SystemHealer locks users into aggressive scareware workflows, claiming system collapse is imminent unless the victim purchases an expensive annual software license. It creates background scheduled tasks and autorun registry keys to display persistent nag screens and prevent uninstallation.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA:Win32/SystemHealer",
    "Program:Win32/SystemHealer",
    "Rogue:Win32/SystemHealer",
    "Win32/SystemHealer",
    "PUA.SystemHealer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PUA:Win32/SystemHealer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "SystemHealer is a rogue system optimizer and scareware PUA that fabricates false computer errors to coerce victims into buying paid licenses."
      }
    },
    {
      "@type": "Question",
      "name": "Are the errors reported by SystemHealer genuine?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No. SystemHealer deliberately exaggerates harmless temporary files and benign registry keys as critical system errors to scare users."
      }
    },
    {
      "@type": "Question",
      "name": "How does SystemHealer get installed onto computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with third-party software installers, fake Flash updates, and deceptive pop-up advertisements on download portals."
      }
    },
    {
      "@type": "Question",
      "name": "How does SystemHealer persist on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It registers startup tasks in Windows Task Scheduler and creates autorun entries in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
      }
    },
    {
      "@type": "Question",
      "name": "How do you remove SystemHealer completely?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall it via Windows Programs and Features, remove its scheduled tasks, and perform a full scan with Microsoft Defender Antivirus."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1204.002",
    "T1547.001",
    "T1059.003",
    "T1082",
    "T1112"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Software Bundlers",
    "Fake Browser Update Alerts",
    "Malvertising Landing Pages"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Fabricated System Health & Error Reporting",
    "Aggressive Scareware Nag Screen Display",
    "Registry Autostart & Scheduled Task Persistence",
    "Browser Telemetry & Installation Reporting",
    "Deceptive Payment Portal Redirection"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (GUI Application)",
      "Installer Setup Package"
    ],
    "network_signatures": [
      "HTTP/HTTPS GET requests transmitting installation telemetry and affiliate tracking IDs to vendor monetization servers",
      "Automated browser launching directing victims to commercial payment gateways"
    ],
    "evasion_techniques": [
      "Using legitimate-looking digital certificates to bypass basic SmartScreen warnings",
      "Disabling easy uninstallation by running background watchdog processes"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "37c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4",
      "48d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SystemHealer",
      "HKLM\\SOFTWARE\\SystemHealer"
    ],
    "file_paths": [
      "%ProgramFiles%\\SystemHealer\\SystemHealer.exe",
      "%AppData%\\SystemHealer\\scan_results.xml",
      "%LocalAppdata%\\Temp\\sh_setup.exe"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Microsoft Defender",
    "Educate users against downloading software optimizers or trusting fake browser update alerts",
    "Enforce AppLocker policies restricting unauthorized executables from running in user appdata paths"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - PUA:Win32/SystemHealer",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PUA:Win32/SystemHealer"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Rogue.Win32.SystemHealer",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "PUA:Win32/SystemHealer.A",
      "Program:Win32/SystemHealer.gen"
    ]
  },
  "motivation": "Financial Fraud, Scareware Coercion & Licensing Fees",
  "sample_hashes": []
}