Malware: CORESHELL

Description

[CORESHELL](https://attack.mitre.org/software/S0137) is a downloader used by [APT28](https://attack.mitre.org/groups/G0007). The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)

External References

• mitre-attack
• FireEye APT28 January 2017
• FireEye APT28
• Securelist Sofacy Feb 2018

Techniques Used by This Malware

• T1027 — Obfuscated Files or Information
• T1027.016 — Junk Code Insertion
• T1071.001 — Web Protocols
• T1071.003 — Mail Protocols
• T1082 — System Information Discovery
• T1105 — Ingress Tool Transfer
• T1132.001 — Standard Encoding
• T1218.011 — Rundll32
• T1547.001 — Registry Run Keys / Startup Folder
• T1573.001 — Symmetric Cryptography

APT Groups Using This Malware

• APT28