Signed adware abuses updates to deploy antivirus-killing payloads
Summary
Huntress found Dragon Boss Solutions adware silently deploying SYSTEM-level MSI and PowerShell payloads that disable antivirus. Researchers observed over 23,500 infected hosts seeking instructions and sinkholed the unregistered update domain.
Key points
- Huntress traced the campaign to digitally signed potentially unwanted software from Dragon Boss Solutions LLC.
- The software abuses Advanced Installer’s update mechanism to silently install MSI and PowerShell payloads with SYSTEM privileges.
- ClockRemoval.ps1 repeatedly stops security-product services, kills processes, removes files and registry entries, and blocks vendor domains.
- Huntress observed more than 23,500 infected hosts in 124 countries trying to contact the campaign infrastructure.
- Researchers registered and sinkholed the previously unregistered update domain, preventing the operator’s infrastructure from directing those connections.
- Huntress warns the update mechanism could deliver more dangerous payloads and recommends checking for named WMI subscriptions, scheduled tasks, signer activity, hosts-file entries, and suspicious Defender exclusions.
Article Details
- Attack Vectors
- Dragon Boss Solutions LLC-signed adware used Advanced Installer's update mechanism to silently deliver MSI and PowerShell payloads with SYSTEM privileges.
- The update process downloaded Setup.msi disguised as a GIF image.
- ClockRemoval.ps1 ran at boot, logon, and every 30 minutes, stopping antivirus services and processes, deleting files and registry entries, and running vendor uninstallers.
- The script modified the hosts file to block antivirus vendor domains, while scheduled-task and WMI-related artifacts were identified as items for defenders to check.
- Defensive Notes
- Look for WMI event subscriptions containing “MbRemoval” or “MbSetup,” and scheduled tasks referencing “WMILoad” or “ClockRemoval.”
- Review the hosts file for entries blocking antivirus vendor domains.
- Check Microsoft Defender exclusions for suspicious paths such as “DGoogle,” “EMicrosoft,” or “DDapps.”
- Investigate processes signed by Dragon Boss Solutions LLC.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | chromsterabrowser[.]com | Main update domain used by the campaign; Huntress registered it after finding it unregistered and sinkholed infected hosts' connection attempts. |
| DOMAIN | worldwidewebframework3[.]com | Fallback update domain used by the campaign. |
MITRE ATT&CK
T1012 · Query RegistryThe MSI queried the registry to identify installed antivirus products.T1036.008 · Masquerade File TypeThe campaign's Setup.msi payload was disguised as a GIF image.T1053.005 · Scheduled TaskDefenders were advised to look for scheduled tasks referencing WMILoad or ClockRemoval; ClockRemoval.ps1 was configured to run at boot, logon, and every 30 minutes.T1059.001 · PowerShellThe campaign deployed PowerShell payloads, including ClockRemoval.ps1, to disable antivirus protections.T1070.004 · File DeletionClockRemoval.ps1 deleted antivirus installation directories and files, including force-deleting files when vendor uninstallers failed.T1105 · Ingress Tool TransferThe update mechanism retrieved an MSI payload, Setup.msi, from the campaign's update infrastructure.T1112 · Modify RegistryClockRemoval.ps1 deleted antivirus-related registry entries.T1497.001 · System ChecksThe MSI checked whether the system was running in a virtual machine.T1518.001 · Security Software DiscoveryBefore deploying the main payload, the MSI checked the system for installed antivirus products, including Malwarebytes, Kaspersky, McAfee, and ESET.T1562.001 · Disable or Modify ToolsClockRemoval.ps1 disabled antivirus protections by stopping services, killing processes, removing files and registry entries, and preventing products from being reinstalled or updated.
Vendors
Products
Advanced InstallerA digitally signed adware tool distributed by Dragon Boss Solutions LLC uses an Advanced Installer update mechanism to silently deploy MSI and PowerShell payloads that run with SYSTEM privileges and disable antivirusArtificius Browserand promoting various tools (e.g., Chromstera Browser, Chromnius, WorldWideWeb, Web Genius, Artificius Browser) labeled as browsers but detected as PUPs by multiple security solutions.Chromniusin “search monetization research” activity and promoting various tools (e.g., Chromstera Browser, Chromnius, WorldWideWeb, Web Genius, Artificius Browser) labeled as browsers but detected as PUPs by multipleChromstera BrowserLLC, involved in “search monetization research” activity and promoting various tools (e.g., Chromstera Browser, Chromnius, WorldWideWeb, Web Genius, Artificius Browser) labeled as browsers but detected as PUPsEdgeThe researchers say that installers for the Opera, Chrome, Firefox, and Edge browsers are also targeted, likely to avoid potential interference with the adware’s browser hijacking.ESETand querying the registry for installed antivirus (AV) products from Malwarebytes, Kaspersky, McAfee, and ESET.Google ChromeThe researchers say that installers for the Opera, Chrome, Firefox, and Edge browsers are also targeted, likely to avoid potential interference with the adware’s browser hijacking.Kasperskyconnectivity, and querying the registry for installed antivirus (AV) products from Malwarebytes, Kaspersky, McAfee, and ESET.Malwarebytesverifying internet connectivity, and querying the registry for installed antivirus (AV) products from Malwarebytes, Kaspersky, McAfee, and ESET.McAfeeand querying the registry for installed antivirus (AV) products from Malwarebytes, Kaspersky, McAfee, and ESET.Microsoft Defender Antimalware PlatformAdditionally, review the hosts file for entries blocking AV vendor domains and check Microsoft Defender exclusions for suspicious paths such as “DGoogle,” “EMicrosoft,” or “DDapps.”Mozilla FirefoxThe researchers say that installers for the Opera, Chrome, Firefox, and Edge browsers are also targeted, likely to avoid potential interference with the adware’s browser hijacking.OperaThe researchers say that installers for the Opera, Chrome, Firefox, and Edge browsers are also targeted, likely to avoid potential interference with the adware’s browser hijacking.Web Geniusresearch” activity and promoting various tools (e.g., Chromstera Browser, Chromnius, WorldWideWeb, Web Genius, Artificius Browser) labeled as browsers but detected as PUPs by multiple security solutions.WorldWideWebmonetization research” activity and promoting various tools (e.g., Chromstera Browser, Chromnius, WorldWideWeb, Web Genius, Artificius Browser) labeled as browsers but detected as PUPs by multiple security
Tools
Industries
Critical infrastructure41 Operational Technology networks in the energy and transport sectors, and at critical infrastructure providersEducationthat run with SYSTEM privileges and disable antivirus protections on thousands of endpoints across education, utilities, government, and healthcare sectors.Energy41 Operational Technology networks in the energy and transport sectors, and at critical infrastructure providersGovernmentprivileges and disable antivirus protections on thousands of endpoints across education, utilities, government, and healthcare sectors.Healthcaredisable antivirus protections on thousands of endpoints across education, utilities, government, and healthcare sectors.Utilitieswith SYSTEM privileges and disable antivirus protections on thousands of endpoints across education, utilities, government, and healthcare sectors.