YOBALOADERYobaLoader

Generic loader of the Yoba malware chain reported and named by Check Point Research, dropped by YobaDropper as wmpdui.dll and side-loaded by a copy of WMPDMC.exe. It avoids dedicated C2 infrastructure: it reads the profile picture of the Telegram channel yoba_fanclub, uses its last 50 bytes to seed a dictionary-based DGA producing dedyn.io domains (aber.ir in an early variant), fetches an Ed25519-signed, AES-encrypted tasking from their DNS TXT record over Google DNS-over-HTTPS, downloads the payload from Catbox and runs it by injection into svchost.exe, as an executable or as a PowerShell script. In the campaign impersonating ChatGPT and Claude desktop applications the final payload was an XMRig miner mining through Tor, but any PE or PowerShell payload can be delivered. Not attributed to a known actor; Check Point reports indicators of Russian origin.