YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_APT28_Drovorub_Library_And_Unique_Strings

Rule to detect Drovorub-server, Drovorub-agent, and Drovorub-client

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: NSA / FBI
Date: 2020-08-13
Modified: 2026-05-15
Score / Quality: 75 / 85

What this rule detects

Rule to detect Drovorub-server, Drovorub-agent, and Drovorub-client

Targets: Linux ELF.

It defines 7 patterns (7 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-apt28-drovorub-library-and-unique-strings.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_APT28_Drovorub_Library_And_Unique_Strings : FILE
{
	meta:
		description = "Rule to detect Drovorub-server, Drovorub-agent, and Drovorub-client"
		author = "NSA / FBI"
		id = "8e010356-09c7-5897-9cbe-051cd0800502"
		date = "2020-08-13"
		modified = "2026-05-15"
		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt28_drovorub.yar#L24-L43"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "adb0d4cb6d589213e6a125d3cc20fcea8164b697bdd24d897ce75e7c7f06120a"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "Poco" ascii wide
		$s2 = "Json" ascii wide
		$s3 = "OpenSSL" ascii wide
		$a1 = "clientid" ascii wide
		$a2 = "-----BEGIN" ascii wide
		$a3 = "-----END" ascii wide
		$a4 = "tunnel" ascii wide

	condition:
		( filesize > 1MB and filesize < 10MB and ( uint32( 0 ) == 0x464c457f ) ) and ( #s1 > 20 and #s2 > 15 and #s3 > 15 and all of ( $a* ) )
}

Strings (7 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"Poco"	ascii wide
$s2	text	"Json"	ascii wide
$s3	text	"OpenSSL"	ascii wide
$a1	text	"clientid"	ascii wide
$a2	text	"-----BEGIN"	ascii wide
$a3	text	"-----END"	ascii wide
$a4	text	"tunnel"	ascii wide

Condition

( filesize > 1MB and filesize < 10MB and ( uint32( 0 ) == 0x464c457f ) ) and ( #s1 > 20 and #s2 > 15 and #s3 > 15 and all of ( $a* ) )

In plain words (Heuristic)

The file must start with the ELF header — a Linux/Unix executable.
The file must be smaller than 10MB (a cheap guard that skips large files).
The file must be larger than 1MB.
All patterns in ( $a* ) must match.
Pattern $s1 must occur > 20 times.
Pattern $s2 must occur > 15 times.
Pattern $s3 must occur > 15 times.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/

Licence & attribution

Author: NSA / FBI

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 8e010356-09c7-5897-9cbe-051cd0800502

Tags:FILE

SIGNATURE_BASE_APT_APT28_Drovorub_Unique_Network_Comms_Strings
APT / threat actorSignature Base (Florian Roth / Nextron)· NSA / FBI· 2020-08-13