Fake ‘GPT-6’ and Claude Apps Hide a Miner Behind Real Signed Installers

Fake download pages for AI desktop apps are bundling genuine, signed OpenAI and Anthropic installers with a malicious DLL that the real program loads, according to Check Point Research. The campaign, which Check Point calls Yoba, poses as “GPT-5.6 Sol,” “GPT-6 Astra” and “Claude Opus” apps on GitHub and installs a hidden cryptominer. The signed files weren’t tampered with; the attackers just put their own DLL next to them.

t[.]me/yoba_fanclub
gpt-5-6.github[.]io
gpt-6-astra.github[.]io
opus-5-0.github[.]io
github[.]com/gpt-5-6/sol-free-desktop
calm-piano-floats-313.dedyn[.]io
files.catbox[.]moe/z5zpy9.dat
51.89.228[.]250
51.89.231[.]85

ZIP 332e3b685e375aa44a5ec98511fc53be821df46a
ZIP c2b986704406d47dd88ee4e2fcffebc854ff2ce4
YobaDropper 17e8639a00bb32b10cb9cf0d292e9441456ce4bb
YobaDropper 20238b36645fc63139a76b19a480c6a9166472fa
YobaLoader 22661f4bada8167fa0f410b75e53184998990abb
YobaLoader 2ecb5548e9774a3d05e8669e8414dcc366929b79
XMRig ea16728f6928dc77deaddee74a6e736dd5f24fc5

Source article: Tricks from the Past deployed via signed ChatGPT and Claude binaries
Publisher: Check Point Research (YARA rules and DGA analysis credited to @Tera0017)
Published: October 27, 2026
URL: https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/

Executive Summary

Check Point Research tracks a financially motivated campaign it calls Yoba, after the malware family (YobaDropper and YobaLoader) and the Telegram channel t[.]me/yoba_fanclub it uses; no other vendor alias has been published, and Check Point does not tie it to a named group, assessing only that the operator is probably Russian-speaking and working in UTC-4. The actor registered three GitHub accounts in July 2026 (gpt-5-6, gpt-6-astra, opus-5-0), each with a GitHub Pages site advertising a fake AI desktop app (“GPT-5.6 Sol”, “GPT-6 Astra”, “Claude Opus”), pushed them up search results through SEO poisoning, and between Aug. 30 and Sept. 4, 2026 published unencrypted ZIP releases (sol-setup.zip, Setup-Claude.zip, GPT-6-Astra-Setup.zip). Each ZIP holds a genuine, validly signed OpenAI or Anthropic Setup.exe plus a malicious winmm.dll (YobaDropper) that the signed binary sideloads. The dropper only proceeds when its host is named Setup.exe (otherwise it sleeps for about 12.7 days), skips Russian and other CIS keyboard layouts (Ukrainian explicitly excepted), and demands administrator rights. It then copies the legitimate WMPDMC.exe from System32 into %ProgramData%\WMProcess\, writes YobaLoader beside it as wmpdui.dll (XOR key IRANNUMBERONE), and registers a SYSTEM scheduled task disguised as a Microsoft Windows Media Player task with a 3-minute boot delay. YobaLoader, sideloaded by the copied WMPDMC.exe, downloads the profile picture of the Telegram channel, derives a <adjective>-<noun>-<verb>-<0-999>.dedyn[.]io domain from it, reads an Ed25519-signed, AES-encrypted TXT record for that name through Google DNS-over-HTTPS, and fetches the payload URL it contains (observed: files.catbox[.]moe/z5zpy9.dat). The payload is injected into svchost.exe, run from %TEMP%, or run as hidden PowerShell; this wave delivered XMRig 6.26.0 mining to an onion pool through a bundled Tor client. An earlier June 2026 version used a Cursor lure and Startup-folder persistence. There is no dedicated C2 server, so the objective (cryptomining today) can change to any payload by editing a TXT record, and the impact is unauthorized SYSTEM-level code on developer and AI-tool users’ machines. Hunt leads, false-positive expectations, Check Point’s published YARA rules and indicators are detailed below.

ATT&CK chain: Resource Development → Execution → Persistence → Privilege Escalation → Defense Evasion → Discovery → Command and Control → Impact

Hunt Lead Grid

WMProcess Folder and Fake Media Player Task

Once it has administrator rights, YobaDropper creates %ProgramData%\WMProcess\, copies the genuine %SystemRoot%\System32\WMPDMC.exe into it, decrypts its embedded second stage with the XOR key IRANNUMBERONE and writes it beside the copy as wmpdui.dll, so the Microsoft-signed binary sideloads YobaLoader every time it runs. Persistence is a scheduled task that runs the copied WMPDMC.exe as Local System (S-1-5-18), with the author set to Microsoft Corporation, the description Collects device metadata for Windows Media Player., and a boot trigger delayed by PT3M (three minutes after startup); Check Point does not publish the task name. The detection logic is a sweep for the folder and either file name, for any task whose action path points into %ProgramData%\WMProcess\ or whose description matches that string, and for WMPDMC.exe executing from anywhere other than System32 or SysWOW64. The earlier June 2026 variant used a different, equally specific anchor: a Startup-folder shortcut named msdefender_scheduler{7940-8490-6670-1081}.lnk launching %APPDATA%\Microsaft Difendir\msdtc.exe with mswsock.dll beside it, and the sweep should include it.

Use EDR file and process inventory, Security event ID 4698 (task created), the TaskScheduler Operational log and a live query of C:\Windows\System32\Tasks across Windows workstations and servers, sweeping back to June 2026 when the first Yoba variant appeared. The author and description strings alone are weak because many genuine tasks say “Microsoft Corporation”; the folder and action path are what make this precise. Do not hash-block WMPDMC.exe: it is an unmodified Microsoft binary, and blocking its hash breaks Windows Media Player components while doing nothing about the DLL. Any hit means YobaLoader has SYSTEM persistence: escalate to incident response, collect the wmpdui.dll, disable and export the task, and then check the host for the payload leads below. The pattern of copying a signed system binary into a writable folder next to a planted DLL generalizes to many sideloading families.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence / Privilege Escalation → T1053.005 (Scheduled Task/Job: Scheduled Task); Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location). Check Point publishes no ATT&CK table; T1053.005 matches the AlienVault OTX pulse for this report, and T1036.005 is added because the source describes the task and copied binary posing as Windows Media Player components.

Sources: “Tricks from the Past deployed via signed ChatGPT and Claude binaries”, Check Point Research, Oct. 27, 2026, https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ (source article)

YobaDropper and YobaLoader YARA and Hash Sweep

Check Point published two YARA rules. yoba_dropper matches the dropper’s code, including the DJB2 seed 0x1505, the Setup.exe process-name hash 0xE6C2F326 and the 12.7-day sleep loop; yoba_loader matches the loader’s DJB2 seed 0x1DEB, the WMPDMC.exe name hash 0x552751E3, the Ed25519 public key b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64, the AES key 1d0d1368b4d53f3a6322cf40e84e63db, the mode-dispatch comparison and the svchost.exe target hash 0xC26CDEA5. Both fire on a PE with any two of their strings. The detection logic is to run both rules across file shares, user Downloads and temp folders, %ProgramData% and EDR-collected binaries, together with a sweep for the SHA-1 values in the appendix (two lure ZIPs, five YobaDropper, nine YobaLoader, the XMRig build and the encrypted payload blob). Because the dropper sideloads under the name winmm.dll and the loader under wmpdui.dll, a match on a file with either name outside System32 is close to conclusive.

rule yoba_dropper
{
    meta:
        author = "@Tera0017/Check Point Research"
        description = "YobaDropper"
    strings:
        $code1 = {00 BB 40 0D 03 00 B9 7C 15 00 00 FF D6 31 C0}
        $code2 = {BA 05 15 00 00 0F BE 08 84 C9 74 0A 6B D2 21}
        $code3 = {53 B9 75 EE 40 70 48 83 EC 20}
        $code4 = {BA 5C CD 17 E5 48 89 C1 E8 73 00 00 00}
        $code5 = {0F C8 89 C0 4? 39 ?? 74 1? (49 0F AF C0| 48 69 C0 ?? ?? ?? ??) (4C 01 C8| 48 05 ?? ?? ?? ??) 49 89 C? 49 C1 E? 18 45 30 [2] 4? FF ?? EB}
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

rule yoba_loader
{
    meta:
        author = "@Tera0017/Check Point Research"
        description = "YobaLoader"
    strings:
        $code1 = {B9 80 A8 12 01 FF ?? ?? E9}
        $code2 = {BA EB 1D 00 00 0F BE 08 84 C9 74 0A 6B D2 21}
        $code3 = {B9 5B 80 EF B7 E8}
        $code4 = {BA F5 8B 2E F2 48 89 C1}
        $code5 = {B5 C2 D2 06 23 D4 E6 64 7D 06 A4 28 64 ED D8 62 9F 82 C5 C3 84 B2 43 FD AE EE CA 24 B3 87 3D 64}
        $code6 = {1D 0D 13 68 B4 D5 3F 3A 63 22 CF 40 E8 4E 63 DB}
        $code7 = {40 80 FE 32 74 42 40 80 FE 33 74 66 40 80 FE 31}
        $code8 = {41 81 F8 A5 DE 6C C2}
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

(YARA rules reproduced verbatim from the source article.)

Run the rules through an EDR or YARA-capable scanner on endpoints and in a retrospective scan of any malware repository or sandbox archive, prioritizing developer workstations and anyone who installs AI tools, and keep them in place for new files. The two signed binaries Check Point lists (163c8118... and 65a3ac8f...) are genuine OpenAI and Anthropic installers: never hash-block or quarantine them, because that breaks legitimate installs and does nothing to the DLL, which is the actual malware. Hash sweeps are useful for the retrospective look but will miss new builds; the YARA rules key on constants the operator would have to rework, so they last longer. A hit on a file that was executed is an escalation, and the next step is the WMProcess lead on the same host; a hit on an unopened ZIP in Downloads is a cleanup and user-awareness case.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Execution → T1204.002 (User Execution: Malicious File); Persistence / Defense Evasion → T1574.001 (Hijack Execution Flow: DLL). The OTX pulse for this report maps the sideloading to T1574.002 (DLL Side-Loading), which current ATT&CK has merged into T1574.001.

Sources: “Tricks from the Past deployed via signed ChatGPT and Claude binaries”, Check Point Research, Oct. 27, 2026, https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ (source article; YARA rules and hashes)

Yoba Lure and Tasking Infrastructure

The lure chain and the tasking chain both run on public services, which gives a short list of exact strings to sweep for. On the lure side: the GitHub Pages sites gpt-5-6.github[.]io, gpt-6-astra.github[.]io and opus-5-0.github[.]io, the repository github[.]com/gpt-5-6/sol-free-desktop and the matching *.github.io repositories, and downloads named sol-setup.zip, Setup-Claude.zip or GPT-6-Astra-Setup.zip. On the tasking side: HTTP requests to t[.]me/yoba_fanclub with the bare user agent Mozilla/5.0 (Windows NT 10.0; Win64;), the Telegram profile image whose SHA-1 is e7c0e981f81447892995d01ed986c0b462a6f0c5, DoH requests to dns[.]google/resolve?name=calm-piano-floats-313.dedyn[.]io&type=TXT, the payload URL files.catbox[.]moe/z5zpy9.dat, and miner connections to 51.89.228[.]250:21668 and 51.89.231[.]85:24526. The detection logic is a sweep of proxy, DNS and firewall logs for these exact hosts and URLs, plus any *.dedyn[.]io name of the three-words-and-a-number form appearing in a dns.google/resolve query string.

Use secure web gateway or proxy logs (which see the full URL and user agent when TLS is inspected), DNS logs for the GitHub Pages hosts, and firewall or NetFlow for the two IPs; sweep back to August 2026, when the releases went up. Blocking the specific GitHub Pages hosts, the Telegram channel and the Catbox file is reasonable, but blocking dedyn[.]io, catbox[.]moe, t[.]me or dns.google wholesale is the wrong control for most organizations, because each has legitimate users, and the actor can rotate the DGA domain just by changing the channel picture. Note that a TLS-uninspected proxy will only see dns.google, not the query name, so this lead depends on inspection. A download of a lure ZIP is a user-awareness case unless the YARA or WMProcess leads also hit; a connection to the tasking chain from a non-browser process is an escalation.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Resource Development → T1608.006 (Stage Capabilities: SEO Poisoning); Command and Control → T1102.001 (Web Service: Dead Drop Resolver). T1608.006 is assigned because the source says the GitHub Pages sites were promoted through SEO poisoning; T1102.001 because the Telegram channel picture seeds the domain the loader resolves. The OTX pulse maps the Telegram use to T1102.002 (Web Service: Bidirectional Communication); the source describes only a one-way read, so T1102.001 fits better.

Sources: “Tricks from the Past deployed via signed ChatGPT and Claude binaries”, Check Point Research, Oct. 27, 2026, https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ (source article)

Signed Installer Sideloading winmm.dll From a Download Folder

The first-stage trick is old: a genuine, validly signed OpenAI or Anthropic Setup.exe sits in the same extracted folder as a malicious winmm.dll, and Windows’ DLL search order loads the local copy before the System32 one. The fake DLL exports all 180 of the real library’s functions as empty stubs (a C3 return followed by NOPs), so only DllEntryPoint does anything, and Check Point identified it as the malicious file because its compile timestamp matches the day it was added to the archive. If the host process isn’t named Setup.exe it stalls for about 12.7 days, and if it isn’t elevated it shows “Please run this program as Administrator.” and exits, so a real infection typically shows a UAC prompt for Setup.exe run from a Downloads or temp extraction folder. The detection logic is an image-load rule (Sysmon event ID 7 or EDR module loads) for winmm.dll, and other System32 library names, loaded from any path outside %SystemRoot%\System32 or SysWOW64 by a process running from a user-writable location, with the DLL unsigned while the parent executable is signed; the same rule on the second stage catches wmpdui.dll loaded by WMPDMC.exe outside System32.

Image-load telemetry is noisy, so scope the rule to library names that legitimately live only in System32 and to processes launched from Downloads, %TEMP%, %APPDATA% or %ProgramData%; allowlist known portable applications and games by full path and signer, not by process name. Consider an elevated-severity variant when the process is named Setup.exe and requested elevation within seconds of the load. Blocking by the OpenAI or Anthropic signature would be the wrong choice, since the signed files are genuine; the anomaly is the unsigned, same-folder system DLL. Application control that refuses unsigned DLLs from user-writable paths prevents this whole class. Any hit should be triaged by pulling the DLL and running the YARA rules above; a YARA match is an incident. This lead generalizes to most DLL-sideloading campaigns that bundle a signed executable with a planted library.

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence / Privilege Escalation / Defense Evasion → T1574.001 (Hijack Execution Flow: DLL); the source’s keyboard-layout exclusion is T1614.001 (System Location Discovery: System Language Discovery) and is not detectable on its own.

Sources: “Tricks from the Past deployed via signed ChatGPT and Claude binaries”, Check Point Research, Oct. 27, 2026, https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ (source article)

Tor-Proxied XMRig Hidden in svchost

In the observed wave, YobaLoader’s mode 1 injected XMRig 6.26.0 into an existing svchost.exe using NtWriteVirtualMemory and NtCreateThreadEx. The miner runs with a hidden command line, TLS on, the pool 3zciedc3enu4muwc5adxciyk6u3juhvhvbv6bfrk2arawlvb7k7ovxad[.]onion:443 reached through a SOCKS5 proxy at 127.0.0[.]1:9550, the donation level at 0 and an 85% CPU hint; it holds the mutex Local\WindowsSecurity, unpacks Tor 0.4.9.12 and lyrebird 0.8.1 (obfs4 bridges) with a data directory at %TEMP%\torbundle\data, resumes mining after 240 seconds of user inactivity, and may load the WinRing0 driver service for MSR tuning. The detection logic is a host rule for any of these artifacts (the torbundle path, a tor or lyrebird process started from %TEMP%, a listener on 9550, the mutex, a new WinRing0 service) and a behavioral rule for svchost.exe with an established loopback connection to that port combined with sustained high CPU that starts after the console goes idle.

Use EDR process, network and mutex telemetry, service-creation events (System event ID 7045) for WinRing0, and host performance data where available; sweep back to late August 2026. The idle-only behavior means CPU spikes appear mostly overnight or at lunch, so baselines built on working-hours data will miss it. Allowlist sanctioned Tor installations by signed path, never by process name, because the bundled client is genuine Tor. Do not try to block the onion pool or the IPs as the main control; the miner reaches its pool over Tor and the payload can be changed via the TXT record, so detection on the host behavior lasts longer. A hit means the loader is live on the host: escalate, kill the injected thread by isolating the host, and trace back through the WMProcess lead, since the miner is only the current payload. Idle-aware miners hidden in svchost.exe and tunneled through a bundled Tor client are a common pattern well beyond Yoba.

Hunt Lead Level: 2 (Pro)

ATT&CK: Impact → T1496.001 (Resource Hijacking: Compute Hijacking); Command and Control → T1090.003 (Proxy: Multi-hop Proxy). T1090.003 is assigned because the source describes the miner reaching its pool through a bundled Tor client.

Sources: “Tricks from the Past deployed via signed ChatGPT and Claude binaries”, Check Point Research, Oct. 27, 2026, https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ (source article)

Telegram-to-DoH-to-File-Host Sequence From One Process

YobaLoader’s tasking leaves a distinctive three-step network sequence from one process, shortly after boot (the task has a 3-minute delay): an HTTPS request to t[.]me for the channel page, a second request to the Telegram CDN for the profile image, a DNS-over-HTTPS TXT query to dns.google/resolve for the DGA name, then an HTTPS download from a file host (Catbox in the observed sample). After decrypting the payload with the same AES key, it either injects into svchost.exe (mode 1), writes and runs %TEMP%\<10 random chars>\<10 random chars>.exe after deleting its Zone.Identifier stream (mode 2), or writes a .ps1 to a similar random folder and runs it with -WindowStyle Hidden -ExecutionPolicy Bypass -File (mode 3). The detection logic correlates per process: a non-browser process (especially WMPDMC.exe or any process from %ProgramData%) contacting Telegram, then Google or another public DoH endpoint, then a file-sharing host within a few minutes, followed by a remote thread into svchost.exe, a new executable in a ten-character %TEMP% subfolder or a hidden PowerShell launch.

This needs process-to-network joins: EDR network events (or Sysmon event ID 3 and 22) with process attribution, joined to process creation, file creation and remote-thread events (Sysmon event ID 8) on the same host, in a stateful rule with a window of around ten minutes. Maintain an allowlist of approved DoH clients (browsers and sanctioned resolvers), because Windows and browsers can use DoH legitimately; outside that list, a non-browser process doing DoH TXT lookups is rare on its own and worth a lower-severity alert. Blocking public DoH at the egress is a valid hardening step for managed fleets, but blocking Telegram or file hosts wholesale is usually the wrong choice. Removal of the Zone.Identifier stream right before execution is a useful supplementary signal. A correlated hit is an incident, not a tuning case. The approach generalizes to any loader that resolves tasking through a dead drop and DoH instead of a fixed C2 server.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1568.002 (Dynamic Resolution: Domain Generation Algorithms), T1071.001 (Application Layer Protocol: Web Protocols); Defense Evasion / Privilege Escalation → T1055 (Process Injection), T1553.005 (Subvert Trust Controls: Mark-of-the-Web Bypass); Execution → T1059.001 (Command and Scripting Interpreter: PowerShell). The OTX pulse also maps the TXT lookup to T1071.004 (Application Layer Protocol: DNS); because the lookup travels over HTTPS to a DoH endpoint, it is detected as web traffic here.

Sources: “Tricks from the Past deployed via signed ChatGPT and Claude binaries”, Check Point Research, Oct. 27, 2026, https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ (source article)

Hash Appendix

All hashes below come from the source article, which publishes SHA-1 only. AlienVault OTX has pulses for this report (including AlienVault’s own) that reproduce the article’s SHA-1 list, but no per-file MD5 or SHA-256 mapping was retrieved, so those are not available; VirusTotal was not queried.

Lure ZIP archives

SHA-1 from the source article; MD5 and SHA-256 not available.

MD5s

(not available)  # sol-setup.zip / Setup-Claude.zip / GPT-6-Astra-Setup.zip (GitHub release lures)

SHA1s

332e3b685e375aa44a5ec98511fc53be821df46a  # lure ZIP from GitHub release (signed Setup.exe + winmm.dll)
c2b986704406d47dd88ee4e2fcffebc854ff2ce4  # lure ZIP from GitHub release (signed Setup.exe + winmm.dll)

SHA256s

(not available)  # lure ZIPs

Signed OpenAI and Anthropic installers (legitimate)

SHA-1 from the source article. These are unmodified, legitimately signed vendor binaries used as sideloading hosts under the name Setup.exe: do not block or quarantine these hashes, which would break legitimate installs; detect the planted winmm.dll, the folder and the parentage instead.

MD5s

(not available)  # Setup.exe (legitimate signed OpenAI / Anthropic installer)

SHA1s

163c81187d8024123912c3c12d905fd5210afcb3  # Setup.exe -> legitimate signed vendor installer inside lure ZIP (do NOT block)
65a3ac8f341ae04982005fd2c4e83627a68793a3  # Setup.exe -> legitimate signed vendor installer inside lure ZIP (do NOT block)

SHA256s

(not available)  # Setup.exe (legitimate signed installers)

YobaDropper

SHA-1 from the source article; MD5 and SHA-256 not available.

MD5s

(not available)  # winmm.dll (YobaDropper)

SHA1s

17e8639a00bb32b10cb9cf0d292e9441456ce4bb  # winmm.dll -> beside Setup.exe in extracted lure ZIP (YobaDropper)
20238b36645fc63139a76b19a480c6a9166472fa  # winmm.dll -> beside Setup.exe in extracted lure ZIP (YobaDropper)
4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586  # YobaDropper sample (file name not given)
60aece343959a2e1840f6aaeffa38b73ed21af2c  # YobaDropper sample (file name not given)
8777db31d8df78f36e4544a132d843dfb2a0f026  # YobaDropper sample (file name not given)

SHA256s

(not available)  # YobaDropper

YobaLoader

SHA-1 from the source article; MD5 and SHA-256 not available. Current versions are written as %ProgramData%\WMProcess\wmpdui.dll; earlier versions sideloaded as mswsock.dll under %APPDATA%\Microsaft Difendir\, and the article does not say which sample is which.

MD5s

(not available)  # wmpdui.dll / mswsock.dll (YobaLoader)

SHA1s

22661f4bada8167fa0f410b75e53184998990abb  # YobaLoader -> e.g. %ProgramData%\WMProcess\wmpdui.dll
2ecb5548e9774a3d05e8669e8414dcc366929b79  # YobaLoader -> e.g. %ProgramData%\WMProcess\wmpdui.dll
3fef1af3664429e621d3e0f9408cb5102ef02b84  # YobaLoader sample
55043ea6d102670c014e2be5a8197e70b7c201cb  # YobaLoader sample
79e87a6df59d68b2dbd2c43950df5663d671007c  # YobaLoader sample
7dfcee02732ed89f1ddf25d1689863c26de3df15  # YobaLoader sample
bead5748d813a9828ddb7603a32e52aa15349768  # YobaLoader sample
cf90c4599257e76984a199d98b1fd082b820a54d  # YobaLoader sample
eeedc5c9007d7f01808285e0ae0c0b451bdba003  # YobaLoader sample

SHA256s

(not available)  # YobaLoader

Tasking and payload artifacts

SHA-1 from the source article; MD5 and SHA-256 not available. The image hash identifies the Telegram profile picture used as the DGA seed; it is not malware.

MD5s

(not available)  # Telegram profile image, encrypted payload, XMRig

SHA1s

e7c0e981f81447892995d01ed986c0b462a6f0c5  # t[.]me/yoba_fanclub profile image -> DGA seed (not malicious by itself)
7467b6980440ec27c4e0a8d940672c9f24e14216  # z5zpy9.dat -> encrypted payload from files.catbox[.]moe
ea16728f6928dc77deaddee74a6e736dd5f24fc5  # XMRig 6.26.0 -> injected into svchost.exe

SHA256s

(not available)  # Telegram profile image, encrypted payload, XMRig

References Appendix

• “Tricks from the Past deployed via signed ChatGPT and Claude binaries”, Check Point Research, Oct. 27, 2026, https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/ (source article; campaign analysis, YARA rules, IOCs)
• “Tricks from the Past deployed via signed ChatGPT and Claude binaries” pulse, AlienVault OTX, Oct. 27, 2026, https://otx.alienvault.com/pulse/6ae0b192bfaf2df2545701f0 (hash provenance check and ATT&CK mapping comparison)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/