Unmasking Malware NOROBOT, YESROBOT, and MAYBEROBOT by COLDRIVER.pptx

A presentation on COLDriver malware and its variants.

1. Varinder Kumar @Cyber24x7 www.thegeektoolbox.com State-Sponsored Malware Surge - Unmasking NOROBOT, YESROBOT, and MAYBEROBOT by COLDRIVER

2. 1. Malware Breakdown: NOROBOT, YESROBOT, MAYBEROBOT Contents 2. Origin & Evolution 3. Indicators of Compromise (IOCs) 4. Defense-in-Depth Strategy 5. Final Thoughts

3. Malware Breakdown: NOROBOT, YESROBOT, MAYBEROBOT 01

4. Functionality Initial loader
Fingerprinting
Sandbox evasion Deployment Stage First- stage Stealth Mostly remain undetected and adds or injects executable commands Target Profile NGO staff
Policy advisors Decision Makers NOROBOT

5. Credential harvesting
Browser data exfiltration Functionality Second- stage Deployment Stage Dissidents
Journalists Target Profile YESROBOT

6. Persistence
Lateral movement
Encrypted C2 Third- stage High- value targets with privileged access Functionality Deployment Stage Target Profile MAYBEROBOT

7. Origin & Evolution 02

8. Emerged just five days after the public disclosure of COLDRIVER’s previous tool, LOSTKEYS. Timeline High operational tempo
Premeditated development Development Characteristics Opted for the more modular and evasive ROBOT suite Abandonment of LOSTKEYS Emergence

9. Indicators of Compromise (IOCs) 03

10. HKCU\Software\NOROBOT\Init Registry Key 01 a9f3c1d2... File Hash 02 norobot- checkin[.]ru C2 Domain 03 NOROBOT IOCs

11. File Path %AppData%\Roaming\yesrobot.exe TLS Fingerprint JA3 hash 771,4865,23- 24- 25 C2 IP 185.234.219.101 YESROBOT IOCs

12. mayberobot[.]su Encrypted Traffic mayberobot_persist Scheduled Task Via winlogon.exe DLL Sideloading MAYBEROBOT IOCs

13. Defense-in-Depth Strategy 04

14. Email Filtering & MFA Block spear- phishing vectors
Enforce multi- factor authentication Application Whitelisting Patch Management Prevent execution of unauthorized binaries Regularly update OS and third- party software to close known vulnerabilities Prevention

15. Behavioral Analytics Monitor for unusual registry edits
DLL sideloading
Encrypted outbound traffic Endpoint Detection & Response (EDR) Flag sandbox evasion
Credential scraping behaviors Threat Intelligence Feeds Integrate IOCs into SIEM platforms Detection

16. Isolate & Reimage Quarantine infected endpoints
Perform clean OS reinstalls IOC Sweeps Use YARA rules and IOC lists to scan across infrastructure Incident Response Playbooks Tailor response plans for multi- stage malware scenarios Remediation Build Defense in Depth – with multiple layers of defenses for your assets

17. Final Thoughts 05

18. Proactive Threat Hunting Essential to stay ahead of evolving threats Cross-Sector Intelligence Sharing Enhances collective defense capabilities Resilient Security Operations Critical for NGOs, policy institutions, and civil society groups to invest in robust cyber hygiene Proactive Measures

19. Varinder Thanks