YobaLoader + Overlord RAT DLL Sideloading Wave: OTX Pulse Analysis — Fake AI Tools, VBScript Banking Trojans & CMS.exe Compromise

---
title: DLL Sideloading of System DLLs from Non-Standard Paths (WpcMon / IPHLPAPI / samcli)
id: 4f1a2b8e-9c3d-4e5f-a6b7-c8d9e0f1a2b3
status: experimental
description: Detects DLL sideloading tradecraft observed in CMS.exe compromise and Yoba campaigns where legitimate binaries (e.g. WpcMon.exe) load trojanized system DLLs (IPHLPAPI.DLL, samcli.dll) from non-standard directories such as AppData.
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
    - https://www.huntress.com/blog/camera-management-software-compromise-malware
    - https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
logsource:
    category: image_load
    product: windows
detection:
    selection_dll:
        ImageLoaded|endswith:
            - '\IPHLPAPI.DLL'
            - '\samcli.dll'
    filter_legit_path:
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    selection_suspicious_parent:
        Image|contains:
            - '\AppData\'
            - '\ProgramData\'
            - '\Users\Public\'
            - '\Temp\'
    condition: selection_dll and selection_suspicious_parent and not filter_legit_path
falsepositives:
    - Rare; legitimate software occasionally bundles IPHLPAPI.DLL in its install directory. Investigate signer and parent process.
level: high
tags:
    - attack.defense_evasion
    - attack.t1574.002
---
title: VBScript Spawning Batch or DLL Proxy Execution (Overlord RAT / Lampion Chain)
id: 7a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the multi-stage Overlord RAT / Lampion execution chain where obfuscated VBScript (wscript/cscript) spawns cmd.exe batch stages or proxy execution via rundll32/regsvr32, commonly following phishing delivery of fake protesto legal notices.
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
    - https://www.watchguard.com/wgrd-security-hub/secplicity-blog/how-vbscript-malware-hides-behind-trusted-tools-evade-detection
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\powershell.exe'
            - '\dllhost.exe'
    selection_script_location:
        CommandLine|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Users\Public\'
    condition: selection_parent and selection_child and selection_script_location
falsepositives:
    - Enterprise logon scripts; filter on known-good script paths and signing.
level: high
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1218
---
title: XMRig Cryptominer Deployment Following AI-Themed Installer (YobaLoader)
id: 1b2c3d4e-5f6a-4b5c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects XMRig miner execution and mining-pool network behavior associated with the Yoba campaign distributing miners via fake signed ChatGPT/Claude desktop installers on GitHub.
author: Security Arsenal Threat Intelligence
date: 2026/10/27
references:
    - https://research.checkpoint.com/2026/tricks-from-the-past-deployed-via-signed-chatgpt-and-claude-binaries/
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\xmrig.exe'
        OriginalFileName:
            - 'xmrig.exe'
    selection_cli:
        CommandLine|contains:
            - '--donate-level'
            - 'stratum+tcp://'
            - 'stratum+ssl://'
            - '--coin='
            - 'xmrig'
    condition: selection_img or selection_cli
falsepositives:
    - Legitimate voluntary mining is rare in enterprise environments; validate against approved software inventory.
level: critical
tags:
    - attack.impact
    - attack.t1496

// Hunt: DLL sideloading artifacts + C2 across all three OTX pulses (2026-10-27)
// 1) Module loads of hijacked DLLs from non-standard paths
let suspiciousDllLoads = DeviceImageLoadEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("IPHLPAPI.DLL","samcli.dll")
| where FolderPath !startswith @"C:\Windows\System32" and FolderPath !startswith @"C:\Windows\SysWOW64"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, FolderPath, FileName, SHA256;
// 2) WpcMon.exe or signed AI-branded binaries executing outside install dirs
let suspiciousBinaries = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where (FileName =~ "WpcMon.exe" and FolderPath !startswith @"C:\Windows\System32")
   or (FileName =~ "rs.win32.exe")
   or (FileName has_any ("GPT-5.6","GPT-6","Claude","Astra","Sol") and FolderPath has_any ("AppData","Temp","Downloads","Public"));
// 3) Network connections to pulse C2 infrastructure
let c2Hits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in ("191.96.225.125","45.158.8.213","148.224.62.243","144.172.116.37")
   or RemoteUrl has_any ("1protestorecife.com","2protestodesalvador.com","3protestobelem.com","protestobh.com","protestocampinas.com")
   or RemoteUrl matches regex @"\d?protesto[a-z]+\.com$";
suspiciousDllLoads
| union suspiciousBinaries
| union c2Hits
| order by TimeGenerated desc

# Security Arsenal IOC Hunt — OTX Pulses 2026-10-27 (Yoba / Overlord RAT-Lampion / CMS.exe compromise)
# Run elevated on endpoints or via your RMM/EDR remote shell.

$Report = @()

# 1) Known malicious file hashes (Yoba MD5/SHA1 + CMS campaign SHA256)
$Hashes = @(
  '1d0d1368b4d53f3a6322cf40e84e63db','dcde1f56048fa18657dc4820397592f7',
  '028bfd4c1041dc1f030c9480a463366e6089e661','163c81187d8024123912c3c12d905fd5210afcb3',
  '17e8639a00bb32b10cb9cf0d292e9441456ce4bb','20238b36645fc63139a76b19a480c6a9166472fa',
  '22661f4bada8167fa0f410b75e53184998990abb','249dae41d64583a6a9ebcb60e3ad36d6216dd6e4',
  '1fb4af4862643dcab1459872f723f574f1a588855b020916b600df5c20681144',
  '70b2345302264c41504d59e6a63d6d908969740424b42b7373f10b4c8d74c87a',
  '8f8e88c54a9c56174974711eff99b4beb79536642fcca1902acdc3d4b1fd1035'
)

$SearchPaths = @("$env:APPDATA","$env:LOCALAPPDATA","C:\Users\Public","C:\ProgramData","$env:TEMP")
foreach ($p in $SearchPaths) {
  if (Test-Path $p) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
      $h1 = (Get-FileHash $_.FullName -Algorithm SHA1 -ErrorAction SilentlyContinue).Hash
      $hm = (Get-FileHash $_.FullName -Algorithm MD5  -ErrorAction SilentlyContinue).Hash
      $h2 = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
      if ($Hashes -contains $h1 -or $Hashes -contains $hm -or $Hashes -contains $h2) {
        $Report += [pscustomobject]@{Type='HashMatch'; Path=$_.FullName; Detail="SHA1=$h1 MD5=$hm SHA256=$h2"}
      }
    }
  }
}

# 2) DLL sideloading artifacts: WpcMon.exe outside System32, rs.win32.exe, trojanized DLLs in user dirs
Get-ChildItem -Path 'C:\' -Recurse -Include 'WpcMon.exe','rs.win32.exe' -File -ErrorAction SilentlyContinue | ForEach-Object {
  if ($_.FullName -notlike 'C:\Windows\System32\*') {
    $Report += [pscustomobject]@{Type='SideloadBinary'; Path=$_.FullName; Detail='Legitimate-named binary in non-standard path'}
  }
}
foreach ($p in $SearchPaths) {
  Get-ChildItem -Path $p -Recurse -Include 'IPHLPAPI.DLL','samcli.dll' -File -ErrorAction SilentlyContinue | ForEach-Object {
    $Report += [pscustomobject]@{Type='SideloadDLL'; Path=$_.FullName; Detail='System DLL name in user-writable directory'}
  }
}

# 3) Persistence: Run keys and scheduled tasks referencing AppData/VBS
$RunKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
foreach ($k in $RunKeys) {
  Get-ItemProperty -Path $k -ErrorAction SilentlyContinue | ForEach-Object {
    $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|\.vbs|wscript|cscript|rs\.win32' } | ForEach-Object {
      $Report += [pscustomobject]@{Type='RunKey'; Path=$k; Detail="$($_.Name) = $($_.Value)"}
    }
  }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { ($_.Actions.Execute -match 'wscript|cscript|rs\.win32|WpcMon') -and ($_.Actions.Arguments -match 'AppData|Temp|\.vbs') } | ForEach-Object {
  $Report += [pscustomobject]@{Type='ScheduledTask'; Path=$_.TaskName; Detail=$_.Actions.Execute + ' ' + $_.Actions.Arguments}
}

# 4) Active/historical network connections to campaign C2
$C2 = '191.96.225.125','45.158.8.213','148.224.62.243','144.172.116.37'
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $C2 -contains $_.RemoteAddress } | ForEach-Object {
  $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
  $Report += [pscustomobject]@{Type='C2Connection'; Path=$proc.Path; Detail="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$($_.State)]"}
}

# 5) DNS cache check for protesto-themed domains
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match 'protesto' } | ForEach-Object {
  $Report += [pscustomobject]@{Type='DNSCache'; Path=$_.Entry; Detail=$_.Data}
}

$Report | Format-Table -AutoSize
$Report | Export-Csv -Path "$env:TEMP\otx_hunt_20261027.csv" -NoTypeInformation
Write-Host "`nHunt complete. $($Report.Count) findings written to $env:TEMP\otx_hunt_20261027.csv" -ForegroundColor Yellow