CORESHELL

MITRE
Malware Type:
Other
First seen:
Unknown
Last seen:
Unknown
Details:

[CORESHELL](https://attack.mitre.org/software/S0137) is a downloader used by [APT28](https://attack.mitre.org/groups/G0007). The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)

Associated Techniques (11)
ID ATT&CK Tactics
T1027 Obfuscated Files or Information -
T1027.016 Junk Code Insertion -
T1071.001 Web Protocols -
T1071.003 Mail Protocols -
T1082 System Information Discovery -
T1105 Ingress Tool Transfer -
T1132.001 Standard Encoding -
T1218.011 Rundll32 -
T1547.001 Registry Run Keys / Startup Folder -
T1573.001 Symmetric Cryptography -
T1680 Local Storage Discovery -
Aliases (210)
Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE Sofacy SOURFACE
Used by Actors (1)
APT28
Nation-state
Metadata
ID: 284
Created: 13/01/2026 17:48
Updated: 06/03/2026 16:00