Drovorub

Malware & Tools · Drovorub

· MalwareS0502 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Linux

Description

Drovorub is a Linux malware toolset comprised of an agent, client, server, and kernel modules, that has been used by APT28.(Citation: NSA/FBI Drovorub August 2020)

Tactic Coverage

stealth (4)command and control (4)collection (1)exfiltration (1)execution (1)persistence (1)privilege escalation (1)

Used By (1 groups)

G0007APT28IRON TWILIGHT, SNAKEMACKEREL

Techniques (12)

T1005Data from Local System

collection

T1014Rootkit

stealth

T1027Obfuscated Files or Information

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1059.004Unix Shell

execution

T1070.004File Deletion

stealth

T1071.001Web Protocols

References

https://attack.mitre.org/software/S0502 https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF