Malware: Drovorub

Description

[Drovorub](https://attack.mitre.org/software/S0502) is a Linux malware toolset comprised of an agent, client, server, and kernel modules, that has been used by [APT28](https://attack.mitre.org/groups/G0007).(Citation: NSA/FBI Drovorub August 2020)

External References

• mitre-attack
• NSA/FBI Drovorub August 2020

Techniques Used by This Malware

• T1005 — Data from Local System
• T1014 — Rootkit
• T1027 — Obfuscated Files or Information
• T1041 — Exfiltration Over C2 Channel
• T1059.004 — Unix Shell
• T1070.004 — File Deletion
• T1071.001 — Web Protocols
• T1090.001 — Internal Proxy
• T1095 — Non-Application Layer Protocol
• T1105 — Ingress Tool Transfer
• T1140 — Deobfuscate/Decode Files or Information
• T1547.006 — Kernel Modules and Extensions

APT Groups Using This Malware

• APT28