สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency

Report

Home > List all groups > List all tools > List all groups using tool CORESHELL

Threat Group Cards: A Threat Actor Encyclopedia

Tool: CORESHELL

Names	CORESHELL SOURFACE Sofacy
Category	Malware
Type	Downloader
Description	CORESHELL is a downloader used by APT28. The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.
Information	<https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf> <https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html> <http://www.malware-reversing.com/2012/12/3-disclosure-of-another-0day-malware.html> <http://malware.prevenity.com/2014/08/malware-info.html>
MITRE ATT&CK	<https://attack.mitre.org/software/S0137/>
Malpedia	<https://malpedia.caad.fkie.fraunhofer.de/details/win.coreshell>
AlienVault OTX	<https://otx.alienvault.com/browse/pulses?q=tag:coreshell>

Last change to this tool card: 13 May 2020

Download this tool card in JSON format

Previous: CoreLoader
Next: Corkow

All groups using tool CORESHELL

Changed	Name	Country	Observed
APT groups
	Sofacy, APT 28, Fancy Bear, Sednit		2004-Feb 2024

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Report incidents

+66 (0)2-123-1227

[email protected]