# Tricks from the Past deployed via signed ChatGPT and Claude binaries

Fake ChatGPT/Claude GitHub projects deliver YobaDropper, which sideloads a loader via signed OpenAI/Anthropic binaries and drops an XMRig miner via Telegram-seeded DGA and DoH C2.

- Payout: Real-world hack
- Program: OpenAI
- Analysis by: Check Point Research
- Disclosed: 2026-10-27
- Write-up quality: 8/10
- Original: https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
- Library page: https://bugbountylibrary.com/r/blog%3Aresearch-checkpoint-com-2026-tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries
- Tags: area:os domain:desktop impact:integrity impact:rce kind:incident platform:threat-intel tech:windows technique:reverse-engineering technique:source-review vuln:misconfiguration

**Target:** Windows desktop installers (ZIP releases) with signed Setup.exe hosts and malicious winmm.dll/wmpdui.dll
**Root cause:** Malicious winmm.dll is placed beside a legitimate signed Setup.exe so the host loads it via DLL sideloading; the dropper then copies WMPDMC.exe and drops an XOR-decrypted wmpdui.dll that the signed binary sideloads.
**Steps:**
1. Lure victims to fake GitHub repos (gpt-5-6, gpt-6-astra, opus-5-0) with GitHub.io pages ranking via SEO poisoning; download ZIP release.
2. ZIP contains signed Setup.exe plus malicious `winmm.dll`; running Setup.exe sideloads winmm.dll (YobaDropper).
3. Dropper anti-sandbox: DJB2 hash of host basename must equal `0xE6C2F326` (Setup.exe); else Sleep(5500)x200000.
4. Language check via keyboard layout ID range 0x19-0x44 against bitmask `0xEC0400C8401`, excluding CIS (with explicit exception for 0x22 Ukrainian); requires admin.
5. Creates `%ProgramData%\WMProcess`, copies `WMPDMC.exe` from System32, XOR-decrypts embedded payload with seed `IRANNUMBERONE` to `wmpdui.dll`.
6. Registers scheduled task (author Microsoft Corporation, boot delay PT3M, Local System S-1-5-18) to run WMPDMC.exe and sideload wmpdui.dll (YobaLoader).
7. Loader fetches `t[.]me/yoba_fanclub`, parses `tgme_page_photo_image` src, downloads image, uses last 50 bytes as seed to generate DGA producing `$adj-$noun-$verb-$digit.dedyn[.]io`.
8. Queries `https://dns[.]google/resolve?name=$DGA&type=TXT`, base64-decodes, verifies Ed25519 signature with pubkey `b5c2d206...3d64`, AES-ECB decrypts with key `1d0d1368b4d53f3a6322cf40e84e63db`.
9. Response `1https://files.catbox[.]moe/z5zpy9.dat`; downloads and AES-ECB decrypts payload; method 1 injects into svchost.exe (hash 0xC26CDEA5) via NtWriteVirtualMemory/NtCreateThreadEx.
10. Final payload XMRig 6.26.0 mines to onion endpoint via Tor SOCKS5 proxy 127.0.0.1:9550, pausing on user activity.
**How found:** Analysts compared ZIP contents and compilation timestamps: winmm.dll compiled same day it was added, flagging it as malicious while other files mimic legitimacy; export table stripped to C3/90 stubs confirmed spoofed winmm.dll.
**Exploitation:** Victim runs signed Setup.exe from fake AI-tool ZIP; sideloaded winmm.dll drops and persists wmpdui.dll via scheduled task under SYSTEM, which uses Telegram-image-seeded DGA + Google DoH TXT C2 to fetch and inject an XMRig miner into svchost.exe, mining through Tor to an onion pool.
**Escalation:** Requires admin; persists as Local System via scheduled task; generic loader can deliver any PE/PowerShell payload (methods 1/2/3).
**Insight:** Compilation timestamps vs ZIP entry times quickly isolate the malicious DLL among decoy files; and a loader that hashes its expected host basename reveals prior lure targets (e.g. Cursor.exe hash 0x56221573) even without full campaign visibility.

## Proof of concept (copied exactly from the original report)

**Python DGA script generating dedyn.io domains**

```
from pathlib import Path
import sys

ADJECTIVES = [
 "silver", "amber", "wild", "tiny", "brave", "lucky", "calm",
 "sharp", "swift", "bright", "quiet", "bold", "gentle", "fierce",
 "royal", "mystic", "username", "degenerate", "allblack", "kizta",
 "graf",
]
NOUNS = [
 "tiger", "river", "stone", "cloud", "wolf", "ocean", "forest",
 "mountain", "eagle", "raven", "ember", "comet", "fox", "dragon",
 "piano", "viper", "yoba", "yyoba", "static", "cpp", "example",
]
VERBS = [
 "runs", "jumps", "sings", "sleeps", "flies", "hunts", "burns",
 "floats", "shines", "whispers", "roars", "dreams", "strikes",
 "glides", "watches", "hides", "duty", "free",
]

FNV_MULTIPLIER = 0x1000193
MASK64 = 0xFFFFFFFFFFFFFFFF

def hash_bytes(data: bytes, seed: int) -> int:
 value = seed
 for byte in data:
 value = ((value ^ byte) * FNV_MULTIPLIER) & MASK64
 return value

def generate_domain(image_path: str) -> str:
 image = Path(image_path).read_bytes()
 if len(image) < 50:
 raise ValueError("Image must contain at least 50 bytes")

 tail = image[-50:]

 adjective = ADJECTIVES[hash_bytes(tail, 0x811C9DC5) % len(ADJECTIVES)]
 noun = NOUNS[hash_bytes(tail, 0xAF0154A5) % len(NOUNS)]
 verb = VERBS[hash_bytes(tail, 0xFE5439E4) % len(VERBS)]
 number = hash_bytes(tail, 0xFFA7471A) % 1000

 return f"{adjective}-{noun}-{verb}-{number}.dedyn[.]io"

if __name__ == "__main__":
 image_file = sys.argv[1]
 print(generate_domain(image_file))
```

**YARA rules for YobaDropper and YobaLoader**

```
rule yoba_dropper
{
 meta:
 author = "@Tera0017/Check Point Research"
 description = "YobaDropper"
 strings:
 $code1 = {00 BB 40 0D 03 00 B9 7C 15 00 00 FF D6 31 C0}
 $code2 = {BA 05 15 00 00 0F BE 08 84 C9 74 0A 6B D2 21}
 $code3 = {53 B9 75 EE 40 70 48 83 EC 20}
 $code4 = {BA 5C CD 17 E5 48 89 C1 E8 73 00 00 00}
 $code5 = {0F C8 89 C0 4? 39 ?? 74 1? (49 0F AF C0| 48 69 C0 ?? ?? ?? ??) (4C 01 C8| 48 05 ?? ?? ?? ??) 49 89 C? 49 C1 E? 18 45 30 [2] 4? FF ?? EB}
 condition:
 uint16(0) == 0x5A4D and 2 of them
}

rule yoba_loader
{
 meta:
 author = "@Tera0017/Check Point Research"
 description = "YobaLoader"
 strings:
 $code1 = {B9 80 A8 12 01 FF ?? ?? E9}
 $code2 = {BA EB 1D 00 00 0F BE 08 84 C9 74 0A 6B D2 21}
 $code3 = {B9 5B 80 EF B7 E8}
 $code4 = {BA F5 8B 2E F2 48 89 C1}
 $code5 = {B5 C2 D2 06 23 D4 E6 64 7D 06 A4 28 64 ED D8 62 9F 82 C5 C3 84 B2 43 FD AE EE CA 24 B3 87 3D 64}
 $code6 = {1D 0D 13 68 B4 D5 3F 3A 63 22 CF 40 E8 4E 63 DB}
 $code7 = {40 80 FE 32 74 42 40 80 FE 33 74 66 40 80 FE 31}
 $code8 = {41 81 F8 A5 DE 6C C2}
 condition:
 uint16(0) == 0x5A4D and 2 of them
}
```

**Git commit metadata of malicious repos**

```
Repository: /gpt-5-6/sol-free-desktop
==================================================
[2026-07-16T14:39:40Z] Author: gpt-5-6 
tree aebceccb0f3303806c35a73da865b684594487c1
author gpt-5-6 <[email protected]> 1784212780 +0400
committer GitHub <[email protected]> 1784212780 +0400

Initial commit
==================================================

Repository: /gpt-5-6/gpt-5-6.github.io
==================================================
[2026-07-16T14:44:31Z] Author: gpt-5-6 
tree 249dae41d64583a6a9ebcb60e3ad36d6216dd6e4
author gpt-5-6 <[email protected]> 1784213071 +0400
committer GitHub <[email protected]> 1784213071 +0400

Initial commit
==================================================

Repository: /opus-5-0/opus-5-0.github.io
==================================================
[2026-08-31T21:33:26Z] Author: opus-5-0 
tree 46ae1f147cf70d4df1471f0e9df46b654d11fe9c
author opus-5-0 <[email protected]> 1788212006 -0400
committer GitHub <[email protected]> 1788212006 -0400

Create readme.md
==================================================

Repository: /gpt-6-astra/gpt-6-astra.github.io
==================================================
[2026-09-04T22:56:13Z] Author: gpt-6-astra 
tree 028bfd4c1041dc1f030c9480a463366e6089e661
author gpt-6-astra <[email protected]> 1788562573 +0300
committer GitHub <[email protected]> 1788562573 +0300

Initial commit
```