EN PT-BR
← Voltar ao feed
high

Yoba campaign uses fake GitHub AI apps and DLL sideloading in signed binaries to deploy YobaLoader and XMRig

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 06:14 · coletado há 1 hora

Check Point Research published findings on October 27, 2026 on a campaign called Yoba, which exploits interest in generative AI to spread cryptocurrency-mining malware through fake GitHub projects. The operators ship legitimate signed OpenAI and Anthropic executables (Setup.exe) with a malicious winmm.dll (YobaDropper), which sideloads and installs YobaLoader. Repositories and GitHub Pages sites advertised fake desktop apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus, and ranked high in Google results, which Check Point attributes to SEO poisoning. The observed final payload was XMRig 6.26.0, but the loader accepts any PE or PowerShell payload, so later waves could deliver stealers or RATs (none documented). Check Point cites Russian-origin indicators and a likely UTC-4 working time zone, with inconsistent commit timestamps that may be deliberate obfuscation.

Detalhes técnicos

  • First repository dates to mid-July 2026; malicious ZIP releases appeared on August 30, August 31 and September 4. The ZIPs were not password-protected. Stars and forks showed no manipulation.
  • YobaDropper spoofs the Windows multimedia library with 180 export stubs that only return. All logic is in the entry point. It hashes the host process name with DJB2 and expects Setup.exe; otherwise it runs 200,000 sleeps of 5.5 seconds (about 12.7 days) to defeat sandboxes.
  • It checks the keyboard layout and skips systems in Russia and other CIS countries (Ukraine explicitly exempted), and requires administrator rights.
  • It creates C:\ProgramData\WMProcess, copies the Windows binary WMPDMC.exe there, XOR-decrypts the embedded payload and writes it as wmpdui.dll (YobaLoader), which WMPDMC.exe sideloads.
  • Persistence is a scheduled task running as Local System three minutes after boot, claiming Microsoft Corporation as author with a Windows Media Player description.
  • C2 avoids dedicated servers. YobaLoader fetches the profile image of Telegram channel t[.]me/yoba_fanclub and feeds its last 50 bytes into a DGA (adjective, noun, verb and number lists) producing domains under dedyn[.]io. Changing the channel photo changes the domain.
  • It queries Google's DoH resolver for the domain's TXT record, verifies it with an Ed25519 signature and decrypts it with AES-ECB, yielding a payload URL (Catbox in this case).
  • A character after the URL selects the execution mode: 1 injects into svchost.exe; 2 drops an EXE in a random temp folder after stripping Zone.Identifier; 3 runs a hidden PowerShell script with execution policy bypass.
  • Mode 1 delivered XMRig 6.26.0, which connects to an onion pool through a local Tor SOCKS5 proxy with the lyrebird obfs4 transport, pauses while the user is active and can load the WinRing0 driver.
  • An earlier June 2026 variant expected Cursor.exe, persisted via a Startup-folder shortcut, used the .aber[.]ir suffix, and had anti-debugging and VM-scoring checks later removed. Regional filtering initially excluded only Russia and later expanded into the dropper. The Telegram channel stayed constant.

Remediação

  • Block software from unverified repositories and do not treat a valid signature as sufficient when unexpected DLLs sit beside the executable.
  • Hunt for the WMProcess folder, WMPDMC.exe running outside System32, Local System scheduled tasks with Microsoft authorship, and Telegram or DoH lookups from non-browser processes.

Linha do tempo

  1. gbhackers.com ↗ · pub. 03/11/2026 06:14 · coletado 03/11 08:00 primeiro registro

    Yoba campaign uses fake GitHub AI apps and DLL sideloading in signed binaries to deploy YobaLoader and XMRig

    ler a análise desta fonte

    Check Point Research published findings on October 27, 2026 on a campaign called Yoba, which exploits interest in generative AI to spread cryptocurrency-mining malware through fake GitHub projects. The operators ship legitimate signed OpenAI and Anthropic executables (Setup.exe) with a malicious winmm.dll (YobaDropper), which sideloads and installs YobaLoader. Repositories and GitHub Pages sites advertised fake desktop apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus, and ranked high in Google results, which Check Point attributes to SEO poisoning. The observed final payload was XMRig 6.26.0, but the loader accepts any PE or PowerShell payload, so later waves could deliver stealers or RATs (none documented). Check Point cites Russian-origin indicators and a likely UTC-4 working time zone, with inconsistent commit timestamps that may be deliberate obfuscation.

    Technical Details

    • First repository dates to mid-July 2026; malicious ZIP releases appeared on August 30, August 31 and September 4. The ZIPs were not password-protected. Stars and forks showed no manipulation.
    • YobaDropper spoofs the Windows multimedia library with 180 export stubs that only return. All logic is in the entry point. It hashes the host process name with DJB2 and expects Setup.exe; otherwise it runs 200,000 sleeps of 5.5 seconds (about 12.7 days) to defeat sandboxes.
    • It checks the keyboard layout and skips systems in Russia and other CIS countries (Ukraine explicitly exempted), and requires administrator rights.
    • It creates C:\ProgramData\WMProcess, copies the Windows binary WMPDMC.exe there, XOR-decrypts the embedded payload and writes it as wmpdui.dll (YobaLoader), which WMPDMC.exe sideloads.
    • Persistence is a scheduled task running as Local System three minutes after boot, claiming Microsoft Corporation as author with a Windows Media Player description.
    • C2 avoids dedicated servers. YobaLoader fetches the profile image of Telegram channel t[.]me/yoba_fanclub and feeds its last 50 bytes into a DGA (adjective, noun, verb and number lists) producing domains under dedyn[.]io. Changing the channel photo changes the domain.
    • It queries Google's DoH resolver for the domain's TXT record, verifies it with an Ed25519 signature and decrypts it with AES-ECB, yielding a payload URL (Catbox in this case).
    • A character after the URL selects the execution mode: 1 injects into svchost.exe; 2 drops an EXE in a random temp folder after stripping Zone.Identifier; 3 runs a hidden PowerShell script with execution policy bypass.
    • Mode 1 delivered XMRig 6.26.0, which connects to an onion pool through a local Tor SOCKS5 proxy with the lyrebird obfs4 transport, pauses while the user is active and can load the WinRing0 driver.
    • An earlier June 2026 variant expected Cursor.exe, persisted via a Startup-folder shortcut, used the .aber[.]ir suffix, and had anti-debugging and VM-scoring checks later removed. Regional filtering initially excluded only Russia and later expanded into the dropper. The Telegram channel stayed constant.

    Remediation

    • Block software from unverified repositories and do not treat a valid signature as sufficient when unexpected DLLs sit beside the executable.
    • Hunt for the WMProcess folder, WMPDMC.exe running outside System32, Local System scheduled tasks with Microsoft authorship, and Telegram or DoH lookups from non-browser processes.