Xakerlar imzolangan OpenAI va Anthropic binar fayllarida DLL sideloadingdan foydalanib YobaLoader zararli dasturini tarqatmoqda

Yoba deb kuzatilgan kampaniya generativ sun'iy intellektga qiziqishdan foydalanib, soxta GitHub loyihalari orqali kriptovalyuta qazib olish zararli dasturini tarqatadi.

Check Point Research 2026-yil 27-oktabrda, taxminan ikki oy kuzatuvdan so'ng, o'z xulosalarini e'lon qildi.

Operatorlar haqiqiy, imzolangan OpenAI va Anthropic bajariladigan fayllarini zararli winmm.dll bilan birga joylashtiradi, shunda yuklama DLL sideloading orqali yuklanadi.

Birinchi ombor 2026-yil iyul o'rtalariga to'g'ri keladi. Zararli ZIP relizlari 30-avgust, 31-avgust va 4-sentabrda paydo bo'ldi.

Yulduzlar va forklar manipulyatsiya qilinmagan, ammo sahifalar Google natijalarida yuqori o'rinlarda turdi, buni Check Point SEO zaharlanishi bilan bog'laydi. ZIP fayllari parol bilan himoyalanmagan, chunki aniqlash darajalari allaqachon past edi.

Har bir arxiv haqiqiy imzolangan Setup.exe va zararli winmm.dll, ya'ni YobaDropper, ni o'z ichiga oladi. DLL Windows multimedia kutubxonasini 180 ta eksport bilan soxtalashtiradi, ular faqat qaytish ko'rsatmalarini o'z ichiga oladi.

Barcha haqiqiy mantiq kirish nuqtasida joylashgan. Dropper o'z xost jarayoni nomini DJB2 bilan xeshlaydi va Setup.exe ni kutadi. Agar tekshiruv muvaffaqiyatsiz bo'lsa, u 5,5 soniyadan 200 000 marta uxlaydi, bu taxminan 12,7 kunni tashkil etadi va sandboxlarni mag'lub qiladi.

Shuningdek, u klaviatura tartibini o'qiydi va Rossiya hamda boshqa MDH mamlakatlaridagi tizimlarni o'tkazib yuboradi, Ukraina esa aniq istisno qilingan. Nihoyat, u administrator huquqlarini talab qiladi.

Dropper C:\ProgramData\WMProcess ni yaratadi va Windows binar fayli WMPDMC.exe ni u yerga nusxalaydi. U o'rnatilgan yuklamani XOR tartibi bilan shifrlaydi va uni wmpdui.dll sifatida yozadi.

Local System sifatida ishlaydigan rejalashtirilgan vazifa nusxani yuklanishdan uch daqiqa keyin ishga tushiradi. Vazifa Microsoft Corporation ni muallif deb da'vo qiladi va Windows Media Player tavsifini o'z ichiga oladi. WMPDMC.exe keyin wmpdui.dll ni sideload qiladi, bu YobaLoader.

Polyswarm tadqiqotchilari aytishicha, hujumchilar GPT-5.6 Sol, GPT-6 Astra va Claude Opus nomli ish stoli ilovalarini reklama qiluvchi omborlar va GitHub Pages saytlarini yaratgan.

Kampaniya maxsus C2 serverlaridan qochadi. YobaLoader Telegram kanali t[.]me/yoba_fanclub profil rasmini oladi.

U rasmning oxirgi 50 baytini sifat, ot, fe'l va raqam ro'yxatlaridan tuzilgan domen generatsiya algoritmiga kiritadi va dedyn[.]io ostidagi nomlarni hosil qiladi.

Kanal fotosuratini o'zgartirish domenni o'zgartiradi, shuning uchun operator binar faylga tegmasdan zararli dastur yo'nalishini o'zgartirishi mumkin.

Keyin loader Google DoH resolveridan domenning TXT yozuvini so'raydi. U javobni Ed25519 imzosi bilan tekshiradi va AES-ECB bilan shifrlaydi. Natija yuklama URL manzili, bu holda Catbox da.

Zanjirni Telegram, Google va Catbox bo'ylab bo'lish yagona C2 domenini bloklashni asosan samarasiz qiladi.

URL dan keyingi belgi uchta bajarish rejimidan birini tanlaydi. 1-rejim svchost.exe ga in'ektsiya qiladi. 2-rejim Zone.Identifier ni olib tashlagandan so'ng tasodifiy temp jildga EXE tushiradi.

3-rejim bajarish siyosatini chetlab o'tish bilan yashiringan PowerShell skriptini ishga tushiradi. Check Point 1-rejim XMRig 6.26.0 ni yetkazganini ko'rdi. Miner mahalliy Tor SOCKS5 proksi orqali onion pool ga ulanadi va Tor bilan lyrebird obfs4 transportidan foydalanadi.

U foydalanuvchi faol bo'lganda qazishni to'xtatadi va optimallashtirish uchun WinRing0 drayverini yuklashi mumkin.

Loader har qanday PE yoki PowerShell yuklamasini qabul qilgani uchun, keyingi to'lqinlar o'g'rilar yoki masofaviy kirish vositalarini yetkazishi mumkin. Bunday yuklamalar hali hujjatlashtirilmagan.

2026-yil iyun oyidagi avvalgi variant Cursor.exe nomli jarayonni kutgan. U Startup jildidagi yorliq orqali doimiylikni ta'minlagan, .aber[.]ir domen qo'shimchasidan foydalangan va keyinchalik olib tashlangan anti-debugging va VM baholash tekshiruvlarini o'z ichiga olgan.

Mintaqaviy filtr dastlab faqat Rossiya tizimlarini istisno qilgan, keyin kengaytirilgan va dropperga ko'chirilgan. Telegram kanali versiyalar bo'yicha doimiy qolgan.

Check Point Rossiya kelib chiqishi ko'rsatkichlari va kompilyatsiya vaqt belgilaridan kelib chiqqan holda UTC-4 ish vaqti zonasini keltiradi. Commit vaqt belgilari nomuvofiq bo'lgan, bu ehtimol aktyorning haqiqiy vaqt zonasini yashirishga qaratilgan ataylab urinishdir.

Himoyachilar tasdiqlanmagan omborlardan dasturiy ta'minotni bloklashi va kutilmagan DLL lar bajariladigan fayl yonida joylashganida haqiqiy imzoni yetarli deb hisoblamasligi kerak.

Shuningdek, ular WMProcess jildini, System32 dan tashqarida ishlaydigan WMPDMC.exe ni, Microsoft muallifligi bilan Local System vazifalarini va brauzer bo'lmagan jarayonlardan Telegram yoki DoH so'rovlarini qidirishlari kerak.

IOC lar

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab defanged (masalan, [.]) qilingan. Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedkasi platformalarida qayta fang qiling.

A campaign tracked as Yoba abuses interest in generative AI to push cryptocurrency-mining malware through fake GitHub projects.

Check Point Research published its findings on October 27, 2026, after about two months of tracking.

The operators pair legitimate, signed OpenAI and Anthropic executables with a malicious winmm.dll, so the payload loads through DLL sideloading.

The first repository dates to mid-July 2026. Malicious ZIP releases appeared on August 30, August 31 and September 4.

Stars and forks showed no manipulation, yet the pages ranked high in Google results, which Check Point attributes to SEO poisoning. The ZIPs were not password-protected, because detection rates were already low.

Each archive contains a genuine signed Setup.exe plus the malicious winmm.dll, called YobaDropper. The DLL spoofs the Windows multimedia library with 180 exports that contain only return instructions.

All real logic sits in the entry point. The dropper hashes its host process name with DJB2 and expects Setup.exe. If the check fails, it runs 200,000 sleeps of 5.5 seconds, roughly 12.7 days, which defeats sandboxes.

It also reads the keyboard layout and skips systems in Russia and other CIS countries, with Ukrainian explicitly exempted. Finally, it demands administrator rights.

The dropper creates C:\ProgramData\WMProcess and copies the Windows binary WMPDMC.exe into it. It decrypts the embedded payload with an XOR routine and writes it as wmpdui.dll.

A scheduled task running as Local System launches the copy three minutes after boot. The task claims Microsoft Corporation as author and carries a Windows Media Player description. WMPDMC.exe then sideloads wmpdui.dll, which is YobaLoader.

Polyswarm Researchers said that, the attackers built repositories and GitHub Pages sites advertising desktop apps named GPT-5.6 Sol, GPT-6 Astra and Claude Opus.

The campaign avoids dedicated C2 servers. YobaLoader fetches the profile image of the Telegram channel t[.]me/yoba_fanclub.

It feeds the image’s last 50 bytes into a domain generation algorithm built from adjective, noun, verb and number lists, producing names under dedyn[.]io.

Changing the channel photo changes the domain, so the operator can retarget the malware without touching the binary.

The loader then asks Google’s DoH resolver for the domain’s TXT record. It verifies the response with an Ed25519 signature and decrypts it with AES-ECB. The result is a payload URL, in this case on Catbox.

Splitting the chain across Telegram, Google and Catbox makes blocking a single C2 domain largely ineffective.

A character after the URL selects one of three execution modes. Mode 1 injects into svchost.exe. Mode 2 drops an EXE into a random temp folder after stripping Zone.Identifier.

Mode 3 runs a PowerShell script hidden with execution policy bypass. Check Point saw mode 1 deliver XMRig 6.26.0. The miner connects to an onion pool through a local Tor SOCKS5 proxyand uses Tor with the lyrebird obfs4 transport.

It pauses mining while the user is active and can load the WinRing0 driver for optimization.

Because the loader accepts any PE or PowerShell payload, later waves could deliver stealers or remote access tools. No such payloads have been documented.

An earlier variant from June 2026 expected a process named Cursor.exe. It persisted through a Startup-folder shortcut, used the .aber[.]ir domain suffix, and included anti-debugging and VM-scoring checks that were later removed.

Regional filtering at first excluded only Russian systems, then expanded and moved into the dropper. The Telegram channel stayed constant across versions.

Check Point cites Russian-origin indicators and a likely UTC-4 working time zone, derived from compilation timestamps. Commit timestamps were inconsistent, likely a deliberate attempt to hide the actor’s real time zone.

Defenders should block software from unverified repositories and treat a valid signature as insufficient when unexpected DLLs sit beside the executable.

They should also hunt for the WMProcess folder, a WMPDMC.exe running outside System32, Local System tasks with Microsoft authorship, and Telegram or DoH lookups from non-browser processes.

IOCs

Note:IP addresses and domains are intentionally defanged (e.g.,[.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.