Threat video1:00
YobaLoader Fake AI Apps Sideload XMRig: Detection & IOCs
YobaLoader hides an XMRig miner behind fake ChatGPT and Claude apps; 9 detection rules, 29 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for YobaLoader Fake AI Apps Sideload XMRig: Detection & IOCs →
Chapters
- 0:00The hookFake AI apps: 703 downloads.
- 0:04The storyPosed as ChatGPT and Claude.
- 0:10Attack pathSetup.exe sideloaded a malicious DLL.
- 0:21AttributionNo threat actor is attributed.
- 0:25Indicators of compromise25 indicators to hunt: 2 IPs, 7 domains and 5 URLs, and more.
- 0:32MITRE ATT&CK techniques21 ATT&CK techniques, from resource development to impact.
- 0:37Remediation5 steps now: Hunt for C:\ProgramData\WMProcess, WMPDMC.exe outside System32 and wmpdui.dll or winmm.dll.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Fake AI apps: 703 downloads.
0:05Posed as ChatGPT and Claude.
0:07Downloaded cryptominers.
0:10Setup.exe sideloaded a malicious DLL.
0:13Generated DGA domains via Telegram.
0:16Routed through Tor.
0:18Mining Monero.
0:22No threat actor is attributed. Confidence: low.
0:2625 indicators to hunt: 2 IPs, 7 domains and 5 URLs, and more.
0:3221 ATT&CK techniques, from resource development to impact.
0:375 steps now: Hunt for C:\ProgramData\WMProcess, WMPDMC.exe outside System32 and wmpdui.dll or winmm.dll.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.