Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
37 IOCs
Tricks from the Past deployed via signed ChatGPT and Claude binaries
Malware Families
Excerpt
Key Points Check Point Research discovered a campaign we track as Yoba where attackers abuse the popularity of AI tools such as ChatGPT and Claude, creating fake GitHub projects that pretend to be desktop applications like GPT-5.6 Sol , GPT-6 Astra , and Claude Opus . The malware is placed next to legitimate, signed executables from OpenAI and Anthropic so it can be loaded indirectly, a technique commonly known as DLL sideloading, which is often used to bypass security…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →37 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 20238b36645fc63139a76b19a480c6a9166472fa | Medium | Score 53/100 | First seen |
| Domain | calm-piano-floats-313.dedyn.io | High | Score 58/100 | First seen |
| IP | 51.89.228.250 | High | Score 58/100 | First seen |
| SHA1 | 79e87a6df59d68b2dbd2c43950df5663d671007c | Medium | Score 53/100 | First seen |
| SHA1 | 3fef1af3664429e621d3e0f9408cb5102ef02b84 | Medium | Score 53/100 | First seen |
| SHA1 | 249dae41d64583a6a9ebcb60e3ad36d6216dd6e4 | Medium | Score 53/100 | First seen |
| SHA1 | c2b986704406d47dd88ee4e2fcffebc854ff2ce4 | Medium | Score 53/100 | First seen |
| SHA1 | 2ecb5548e9774a3d05e8669e8414dcc366929b79 | Medium | Score 53/100 | First seen |
| SHA1 | bead5748d813a9828ddb7603a32e52aa15349768 | Medium | Score 53/100 | First seen |
| SHA1 | 65a3ac8f341ae04982005fd2c4e83627a68793a3 | Medium | Score 53/100 | First seen |
| SHA1 | aebceccb0f3303806c35a73da865b684594487c1 | Medium | Score 53/100 | First seen |
| Domain | dedyn.io | High | Score 58/100 | First seen |
| Domain | digit.dedyn.io | High | Score 58/100 | First seen |
| Domain | github.io | High | Score 86/100 | First seen |
| SHA1 | 8777db31d8df78f36e4544a132d843dfb2a0f026 | Medium | Score 53/100 | First seen |
| SHA1 | 028bfd4c1041dc1f030c9480a463366e6089e661 | Medium | Score 53/100 | First seen |
| SHA1 | 4ea5b71202b69fc27b06ef9ee3f6f51d6f7b8586 | Medium | Score 53/100 | First seen |
| SHA1 | 17e8639a00bb32b10cb9cf0d292e9441456ce4bb | Medium | Score 53/100 | First seen |
| SHA1 | 22661f4bada8167fa0f410b75e53184998990abb | Medium | Score 53/100 | First seen |
| IP | 51.89.231.85 | High | Score 58/100 | First seen |
| Domain | aber.ir | High | Score 58/100 | First seen |
| SHA1 | 7467b6980440ec27c4e0a8d940672c9f24e14216 | Medium | Score 53/100 | First seen |
| SHA1 | 60aece343959a2e1840f6aaeffa38b73ed21af2c | Medium | Score 53/100 | First seen |
| SHA1 | 7dfcee02732ed89f1ddf25d1689863c26de3df15 | Medium | Score 53/100 | First seen |
| SHA1 | eeedc5c9007d7f01808285e0ae0c0b451bdba003 | Medium | Score 53/100 | First seen |
| SHA1 | cf90c4599257e76984a199d98b1fd082b820a54d | Medium | Score 53/100 | First seen |
| SHA1 | ea16728f6928dc77deaddee74a6e736dd5f24fc5 | Medium | Score 53/100 | First seen |
| SHA1 | 163c81187d8024123912c3c12d905fd5210afcb3 | Medium | Score 53/100 | First seen |
| SHA1 | ba8bd67d8898cf378d4f73821deb5657f4bb98df | Medium | Score 53/100 | First seen |
| SHA1 | 46ae1f147cf70d4df1471f0e9df46b654d11fe9c | Medium | Score 53/100 | First seen |
| SHA256 | b5c2d20623d4e6647d06a42864edd8629f82c5c384b243fdaeeeca24b3873d64 | Medium | Score 53/100 | First seen |
| SHA1 | 332e3b685e375aa44a5ec98511fc53be821df46a | Medium | Score 53/100 | First seen |
| SHA1 | e7c0e981f81447892995d01ed986c0b462a6f0c5 | Medium | Score 53/100 | First seen |
| MD5 | dcde1f56048fa18657dc4820397592f7 | Medium | Score 53/100 | First seen |
| SHA1 | a44162645ceaa39c7106c49a3f36fd99ff8d8a00 | Medium | Score 53/100 | First seen |
| MD5 | 1d0d1368b4d53f3a6322cf40e84e63db | Medium | Score 53/100 | First seen |
| SHA1 | 55043ea6d102670c014e2be5a8197e70b7c201cb | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…