Full Report
Huntress uncovered a malware operation using signed PUP to deploy AV killers with SYSTEM privileges. Learn how this adware crosses the line into malware territory and how anyone could have hijacked their update mechanism.
Analysis Summary
# Tool/Technique: Dragon Boss Solutions signed PUP (Potentially Unwanted Program)
## Overview
This threat involves a signed adware/PUP operation by "Dragon Boss Solutions LLC" that utilizes a legitimate-looking update mechanism to deploy malicious payloads. While masquerading as "search monetization research" software, it functions as an aggressive AV-killer, systematically disabling security tools and establishing persistence with SYSTEM privileges. The operation was notable for a critical supply chain vulnerability where its hardcoded update domain was left unregistered.
## Technical Details
- **Type:** Malware family (Adware/Loader/AV Killer)
- **Platform:** Windows
- **Capabilities:** Persistence, Security Software Evasion (AV Killing), Privilege Escalation (SYSTEM), Remote Payload Deployment.
- **First Seen:** Loaders dated late 2024; AV-killing activity observed March 2025.
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription]
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- **[TA0004 - Privilege Escalation]**
- [T1068 - Exploitation for Privilege Escalation] (Abuse of SYSTEM-level service/MSI execution)
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
- [T1553.002 - Subvert Trust Controls: Code Signing]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **Signed Execution:** Uses valid code-signing certificates from Dragon Boss Solutions LLC to bypass basic security checks.
- **Persistence:** Establishes WMI Event Subscriptions and multiple Scheduled Tasks to ensure the malware survives reboots.
- **AV Killing:** Specifically targets and disables security software, including Malwarebytes (referred to as "Mb" in scripts) and Windows Defender.
- **System Privileges:** Executes via `msiexec` and signed services to maintain SYSTEM-level access.
### Advanced Features
- **Hijackable Update Mechanism:** The software was hardcoded to check `chromsterabrowser[.]com` for updates. Because the domain was originally unregistered, any actor could have registered it to push arbitrary payloads (Ransomware, Infostealers) to over 25,000 endpoints.
- **Pseudo-Random Naming:** Uses a **[Word][Word][Number]** pattern (e.g., *RaceCarTwo.exe*, *TableBoatThree*) for file names and directory structures to complicate signature-based detection.
## Indicators of Compromise
- **File Names:**
- `RaceCarTwo.exe`, `TableBoatThree.exe`, `WinSupportNine.exe`
- `ClockRemoval.ps1`
- `Setup.msi`
- **Registry/WMI Names:**
- WMI Filter/Consumer names containing "Mb" or "Removal".
- **Network Indicators:**
- `chromsterabrowser[.]com` (Defanged - Primary Update Domain)
- **Behavioral Indicators:**
- `msiexec.exe` spawning PowerShell scripts that target security service processes.
- Repeated directory patterns: `C:\Program Files (x86)\[Name][Suffix]\[Name]\[Name].exe`.
## Associated Threat Actors
- **Dragon Boss Solutions LLC** (Attributed via Code Signing Certificate)
## Detection Methods
- **Signature-based detection:** Scan for files signed by "Dragon Boss Solutions LLC."
- **Behavioral detection:** Monitor for unauthorized WMI Event Subscriptions and scheduled tasks that execute PowerShell scripts from `Program Files (x86)` subdirectories.
- **Process Monitoring:** Alert on `msiexec` calling PowerShell to interact with security product services or registry keys.
## Mitigation Strategies
- **Certificate Revocation:** Block or untrust certificates issued to "Dragon Boss Solutions LLC."
- **Application Whitelisting:** Implement policies to prevent the execution of PUPs and unsigned/untrusted scripts.
- **DNS Sinkholing:** Ensure traffic to known malicious or hijacked update domains is redirected to a controlled environment.
- **Hardening:** Limit the ability of standard users to install MSI packages or modify WMI subscriptions.
## Related Tools/Techniques
- **Supply Chain Compromise:** Similar to CCleaner or SolarWinds attacks where a trusted update mechanism is subverted.
- **Standard Adware/PUP:** Shares traits with aggressive search-hijacking software.