The original text is in EN, taken from the source site. Source ↗

A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects.

Check Point Research published its findings on October 27, 2026, after about two months of tracking.

The operators pair legitimate, signed OpenAI and Anthropic executables with a malicious winmm.dll, so the payload loads through DLL sideloading.

The first repository dates to mid-July 2026. Malicious ZIP releases appeared on August 30, August 31 and September 4.

Stars and forks showed no manipulation, yet the pages ranked high in Google results, which Check Point attributes to SEO poisoning. The ZIPs were not password-protected, because detection rates were already low.

Each archive contains a genuine signed Setup.exe plus the malicious winmm.dll, called YobaDropper. The DLL spoofs the Windows multimedia library with 180 exports that contain only return instructions.

All real logic sits in the entry point. The dropper hashes its host process name with DJB2 and expects Setup.exe. If the check fails, it runs 200,000 sleeps of 5.5 seconds, roughly 12.7 days, which defeats sandboxes.

It also reads the keyboard layout and skips systems in Russia and other CIS countries, with Ukrainian explicitly exempted. Finally, it demands administrator rights.

The dropper creates C:\ProgramData\WMProcess and copies the Windows binary WMPDMC.exe into it. It decrypts the embedded payload with an XOR routine and writes it as wmpdui.dll.

A scheduled task running as Local System launches the copy three minutes after boot. The task claims Microsoft Corporation as author and carries a Windows Media Player description. WMPDMC.exe then sideloads wmpdui.dll, which is YobaLoader.

Polyswarm Researchers said that, the attackers built repositories and GitHub Pages sites advertising desktop apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus.

The campaign avoids dedicated C2 servers. YobaLoader fetches the profile image of the Telegram channel t[.]me/yoba_fanclub.

It feeds the image’s last 50 bytes into a domain generation algorithm built from adjective, noun, verb and number lists, producing names under dedyn[.]io.

Changing the channel photo changes the domain, so the operator can retarget the malware without touching the binary.

The loader then asks Google’s DoH resolver for the domain’s TXT record. It verifies the response with an Ed25519 signature and decrypts it with AES-ECB. The result is a payload URL, in this case on Catbox.

Splitting the chain across Telegram, Google and Catbox makes blocking a single C2 domain largely ineffective.

A character after the URL selects one of three execution modes. Mode 1 injects into svchost.exe. Mode 2 drops an EXE into a random temp folder after stripping Zone.Identifier.

Mode 3 runs a PowerShell script hidden with execution policy bypass. Check Point saw mode 1 deliver XMRig 6.26.0. The miner connects to an onion pool through a local Tor SOCKS5 proxyand uses Tor with the lyrebird obfs4 transport.

It pauses mining while the user is active and can load the WinRing0 driver for optimization.

Because the loader accepts any PE or PowerShell payload, later waves could deliver stealers or remote access tools. No such payloads have been documented.

An earlier variant from June 2026 expected a process named Cursor.exe. It persisted through a Startup-folder shortcut, used the .aber[.]ir domain suffix, and included anti-debugging and VM-scoring checks that were later removed.

Regional filtering at first excluded only Russian systems, then expanded and moved into the dropper. The Telegram channel stayed constant across versions.

Check Point cites Russian-origin indicators and a likely UTC-4 working time zone, derived from compilation timestamps. Commit timestamps were inconsistent, likely a deliberate attempt to hide the actor’s real time zone.

Defenders should block software from unverified repositories and treat a valid signature as insufficient when unexpected DLLs sit beside the executable.

They should also hunt for the WMProcess folder, a WMPDMC.exe running outside System32, Local System tasks with Microsoft authorship, and Telegram or DoH lookups from non-browser processes.

IOCs

SHA-256 HashMalware
2a61e811669c2fa9f2d9ecbc8d4c0932897409244d352dded764a4fd936c4d1cYobaDropper
e066c6a728ac92d261c1abff7bfce1ad5ebd8b1ef054974431221629ac30d221YobaDropper
2ebf2759195413e44f9e77cc8360976f989ff96e05531d40ec7d05756a1ea9c4YobaDropper
8fe2edd0572ea9f092d80c503d2c6df9026c36bd0ace1a77bdeff9cc99737739YobaDropper

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.