Threat feed

Yoba signed-AI sideload

Yoba: signed ChatGPT/Claude binaries from fake GitHub repos sideload a dropper with Telegram-photo DGA tasking and Tor-mined XMRig

Posted · Updated · Spectrum Delta Research Team

Summary

Check Point Research (Oct 27) documents 'Yoba', a campaign tracked for two months: Likely SEO-poisoned (per CPR) fake GitHub projects pose as GPT-5.6 Sol / GPT-6 Astra / Claude Opus desktop apps and ship the genuinely signed OpenAI or Anthropic Setup.exe next to a malicious winmm.dll that the signed binary sideloads. The YobaDropper stages a Windows-Media-Player-masqueraded scheduled task in ProgramData\WMProcess; the YobaLoader derives tasking domains from the last 50 bytes of a Telegram channel photo, fetches Ed25519-signed AES-encrypted instructions from DNS TXT via Google DoH, and deploys its payload three ways - including XMRig mining through a local Tor SOCKS proxy to an onion endpoint.

Breakdown

Adversary

Unnamed operators tracked by CPR as 'Yoba' - indicators CPR says suggest Russian origins

Procedures (6)

  1. Signed AI-app Setup.exe sideloads winmm.dll dropper

    Signed AI-app installer sideloads winmm.dll dropper

    • T1574.002

    Logs

    • Windows process creation · EID 1/4688: Setup.exe, powershell hidden-bypass, WMPDMC.exe
    • Windows image load · EID 7: winmm.dll by Setup.exe; wmpdui.dll by WMPDMC.exe

    Detectors

    • Potential System DLL Sideloading From Non System Locations · ImageLoad of winmm.dll or wmpdui.dll from non-system location
Click to expand remaining (5) procedures

  1. Dropper stages WMP-masqueraded scheduled-task persistence

    WMP-masqueraded scheduled-task persistence

    Logs

    • Windows file creation · EID 11: winmm/wmpdui DLL drops; random-named temp exe/ps1 creation
    • Windows image load · EID 7: winmm.dll by Setup.exe; wmpdui.dll by WMPDMC.exe
    • Windows scheduled task · EID 4698: author Microsoft Corp, desc WMP metadata, boot trigger, SYSTEM

    Detectors

    • Potential System DLL Sideloading From Non System Locations · ImageLoad of winmm.dll or wmpdui.dll from non-system location

  2. Loader pulls tasking via Telegram-photo DGA over DoH

    Telegram-photo DGA tasking over DoH TXT

    • T1071.001Application Layer Protocol: Web Protocols

    Logs

    • DNS / proxy / flow · Flows to dns.google, t.me, catbox.moe; obfs4 bridge connections

    Detectors

    No known detector

  3. Tasking injects payload into svchost.exe

    Logs

    • Windows remote thread / process access · EID 8/10: remote thread and process access into svchost.exe

    Detectors

    No known detector

  4. Tasking runs payload from temp exe or hidden ps1

    • T1059.001Command and Scripting Interpreter: PowerShell

    Logs

    • Windows file creation · EID 11: winmm/wmpdui DLL drops; random-named temp exe/ps1 creation
    • Windows process creation · EID 1/4688: Setup.exe, powershell hidden-bypass, WMPDMC.exe

    Detectors

    No known detector

  5. XMRig mines via local Tor proxy with WinRing0 service

    XMRig mines via local Tor proxy

    Logs

    • Windows service install · EID 7045: WinRing0 driver service install by loader payload
    • DNS / proxy / flow · Flows to dns.google, t.me, catbox.moe; obfs4 bridge connections

    Detectors

    No known detector

Indicators of compromise

Hunt only

ZIPs 332e3b685e375aa44a5ec98511fc53be821df46a, c2b986704406d47dd88ee4e2fcffebc854ff2ce4; signed OpenAI/Anthropic Setup.exe host binaries (benign context, not standalone malicious indicators) 163c81187d8024123912c3c12d905fd5210afcb3, 65a3ac8f341ae04982005fd2c4e83627a68793a3; YobaDropper (winmm.dll) 17e8639a00bb32b10cb9cf0d292e9441456ce4bb, 20238b36645fc63139a76b19a480c6a9166472fa, 4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586, 60aece343959a2e1840f6aaeffa38b73ed21af2c, 8777db31d8df78f36e4544a132d843dfb2a0f026; YobaLoader (wmpdui.dll) 22661f4bada8167fa0f410b75e53184998990abb, 2ecb5548e9774a3d05e8669e8414dcc366929b79, 3fef1af3664429e621d3e0f9408cb5102ef02b84, 55043ea6d102670c014e2be5a8197e70b7c201cb, 79e87a6df59d68b2dbd2c43950df5663d671007c, 7dfcee02732ed89f1ddf25d1689863c26de3df15, bead5748d813a9828ddb7603a32e52aa15349768, cf90c4599257e76984a199d98b1fd082b820a54d, eeedc5c9007d7f01808285e0ae0c0b451bdba003; Telegram profile image e7c0e981f81447892995d01ed986c0b462a6f0c5; encrypted payload 7467b6980440ec27c4e0a8d940672c9f24e14216; XMRig payload ea16728f6928dc77deaddee74a6e736dd5f24fc5; GitHub pages github.com/gpt-5-6/sol-free-desktop, gpt-5-6.github.io, github.com/gpt-6-astra/gpt-6-astra.github.io, gpt-6-astra.github.io, opus-5-0.github.io, github.com/opus-5-0/opus-5-0.github.io; uploader emails edwardcarlsonmkym@outlook.com, daxschneiderdjuu@outlook.com, rioprestonlfyx@outlook.com; Telegram t.me/yoba_fanclub; ITW tasking dns.google/resolve?name=calm-piano-floats-313.dedyn.io&type=TXT; ITW payload files.catbox.moe/z5zpy9.dat; Ed25519 pubkey b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64; AES-ECB key 1d0d1368b4d53f3a6322cf40e84e63db; mining server 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad.onion:443; pool token dcde1f56048fa18657dc4820397592f7; Tor SOCKS5 127.0.0.1:9550; obfs4 bridges 51.89.231.85:24526 and 51.89.228.250:21668; DGA word lists - adjectives silver/amber/wild/tiny/brave/lucky/calm/sharp/swift/bright/quiet/bold/gentle/fierce/royal/mystic/username/degenerate/allblack/kizta/graf, nouns tiger/river/stone/cloud/wolf/ocean/forest/mountain/eagle/raven/ember/comet/fox/dragon/piano/viper/yoba/yyoba/static/cpp/example, verbs runs/jumps/sings/sleeps/flies/hunts/burns/floats/shines/whispers/roars/dreams/strikes/glides/watches/hides/duty/free, format adjective-noun-verb-0-999.dedyn.io

Durable

Scheduled task with author 'Microsoft Corporation', description 'Collects device metadata for Windows Media Player.', boot trigger with PT3M (3-minute) delay, SYSTEM account (S-1-5-18), executing WMPDMC.exe from C:\ProgramData\WMProcess; a signed Setup.exe loading winmm.dll from a user-writable directory; DJB2 host-name hashes - dropper expects Setup.exe (0xE6C2F326), loader expects WMPDMC.exe (0x552751E3); powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -File against a 10-char random name under %TEMP%\<10 random chars>; DNS-over-HTTPS TXT queries to dns.google/resolve; a Telegram channel photo used as DGA seed - channel-photo changes signal tasking rotation; older June 2026 variant used .aber.ir DGA domains and a Startup-folder shortcut msdefender_scheduler{7940-8490-6670-1081}.lnk executing %APPDATA%\Microsaft Difendir\msdtc.exe sideloading mswsock.dll

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of Yoba signed-AI sideload? Bring them to the community.

Discuss in the Tradecraft Slack