ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool CORESHELL

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: CORESHELL

NamesCORESHELL
SOURFACE
Sofacy
CategoryMalware
TypeDownloader
DescriptionCORESHELL is a downloader used by APT28. The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.
Information<https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf>
<https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html>
<http://www.malware-reversing.com/2012/12/3-disclosure-of-another-0day-malware.html>
<http://malware.prevenity.com/2014/08/malware-info.html>
MITRE ATT&CK<https://attack.mitre.org/software/S0137/>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.coreshell>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:coreshell>

Last change to this tool card: 13 May 2020

Download this tool card in JSON format

Previous: CoreLoader
Next: Corkow

All groups using tool CORESHELL

ChangedNameCountryObserved

APT groups

 Sofacy, APT 28, Fancy Bear, SednitRussia2004-Jun 2021 HOTX

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key