YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_APT28_Drovorub_Unique_Network_Comms_Strings

Rule to detect Drovorub-server, Drovorub-agent, or Drovorub-client based

APT / threat actorSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: NSA / FBI
Date: 2020-08-13
Modified: 2026-05-15
Score / Quality: 75 / 85

What this rule detects

Rule to detect Drovorub-server, Drovorub-agent, or Drovorub-client based

It defines 17 patterns (17 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-apt28-drovorub-unique-network-comms-strings.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_APT28_Drovorub_Unique_Network_Comms_Strings
{
	meta:
		description = "Rule to detect Drovorub-server, Drovorub-agent, or Drovorub-client based"
		author = "NSA / FBI"
		id = "c6a930e8-c1c0-5d96-9051-7516df848b45"
		date = "2020-08-13"
		modified = "2026-05-15"
		reference = "https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_apt28_drovorub.yar#L45-L73"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "8c82766b76c36fe64c6aa99577e1997d7181dbd36a4c27329845ae8a413f5327"
		score = 75
		quality = 85
		tags = ""

	strings:
		$s_01 = "action" wide ascii
		$s_02 = "auth.commit" wide ascii
		$s_03 = "auth.hello" wide ascii
		$s_04 = "auth.login" wide ascii
		$s_05 = "auth.pending" wide ascii
		$s_06 = "client_id" wide ascii
		$s_07 = "client_login" wide ascii
		$s_08 = "client_pass" wide ascii
		$s_09 = "clientid" wide ascii
		$s_10 = "clientkey_base64" wide ascii
		$s_11 = "file_list_request" wide ascii
		$s_12 = "module_list_request" wide ascii
		$s_13 = "monitor" wide ascii
		$s_14 = "net_list_request" wide ascii
		$s_15 = "server finished" wide ascii
		$s_16 = "serverid" wide ascii
		$s_17 = "tunnel" wide ascii

	condition:
		all of them
}

Strings (17 patterns)

Identifier	Type	Value	Modifiers
$s_01	text	"action"	wide ascii
$s_02	text	"auth.commit"	wide ascii
$s_03	text	"auth.hello"	wide ascii
$s_04	text	"auth.login"	wide ascii
$s_05	text	"auth.pending"	wide ascii
$s_06	text	"client_id"	wide ascii
$s_07	text	"client_login"	wide ascii
$s_08	text	"client_pass"	wide ascii
$s_09	text	"clientid"	wide ascii
$s_10	text	"clientkey_base64"	wide ascii
$s_11	text	"file_list_request"	wide ascii
$s_12	text	"module_list_request"	wide ascii
$s_13	text	"monitor"	wide ascii
$s_14	text	"net_list_request"	wide ascii
$s_15	text	"server finished"	wide ascii
$s_16	text	"serverid"	wide ascii
$s_17	text	"tunnel"	wide ascii

Condition

all of them

In plain words (Heuristic)

All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.nsa.gov/news-features/press-room/Article/2311407/nsa-and-fbi-expose-russian-previously-undisclosed-malware-drovorub-in-cybersecu/

Licence & attribution

Author: NSA / FBI

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: c6a930e8-c1c0-5d96-9051-7516df848b45

SIGNATURE_BASE_APT_APT28_Drovorub_Library_And_Unique_Strings
APT / threat actorSignature Base (Florian Roth / Nextron)· NSA / FBI· 2020-08-13