When PUPs Grow Fangs: Dragon Boss Solutions' $10 Supply Chain Risk

What it is

A malware family distributed as Authenticode-signed PUPs from Dragon Boss Solutions LLC (a firm claiming "search monetization research"). Loaders date to late 2024; the AV-killing payloads appeared late March 2025. Huntress flagged it on 22 March 2025 when adware-looking alerts turned out to conceal a multi-stage chain that disables security tools and blocks their reinstallation, all as SYSTEM. The summary covers the $10 domain-hijack angle — this document carries the hunting artifacts it omits.

How it works

A signed grandparent executable (e.g. RaceCarTwo.exe) uses the Advanced Installer update mechanism to poll a remote server, which returns a Setup.msi (served masquerading as a GIF). The MSI spawns via msiexec, registers four scheduled tasks in rapid succession pointing at a single PowerShell script (e.g. ClockRemoval.ps1), and establishes WMI persistence to kill AV. The poll target lives in an .ini config file left on disk (RaceCarTwo.ini) even after the MSI is gone.

Preconditions / Affected

Any host running a Dragon Boss Solutions signed binary. These follow a recognizable shape:

• Names: [Word][Word][Number], e.g. TableBoatThree, WinSupportNine; "World Wide Web" appears frequently.
• Paths: double-encapsulated C:\Program Files (x86)\[Name][Suffix]\[Name]\[Name].exe, where [Suffix] is Solutions or Workstation (e.g. RaceCarTwoolutions\RaceCarTwo\updates\Update\).

What to do

Hunt for these artifacts:

• WMI persistence with names referencing AV, e.g. containing Mb (Malwarebytes) and Removal.
• Bursts of four scheduled tasks created together, all invoking one .ps1 (e.g. ClockRemoval.ps1) from msiexec.
• Leftover *.ini update configs matching the naming pattern; check their poll domains against unregistered/sinkholed status.

Known indicators:

• RaceCarTwo.exe SHA256 909539d3ef8dedc3be56381256713fa5545cc7fd3d3d0e0428f7efb94a7e71cb
• Domains: chromsterabrowser[.]com (primary, was unregistered — now Huntress-sinkholed), worldwidewebframework3[.]com (unregistered fallback), worldwidewebuniverse3[.]com (active), payload host dl.isready26[.]online (e.g. /image/ldk4945jfds.gif).

Caveats

The MSI is typically absent from disk by the time you investigate — the .ini config is your primary lead. The distinction between the two unregistered domains matters: chromsterabrowser[.]com was the primary poll target (no filtering needed to hijack), whereas the RaceCarTwo variant's unregistered domain was only a fallback, reachable only if the active primary failed.