H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

CORESHELL

[CORESHELL](https://attack.mitre.org/software/S0137) is a downloader used by [APT28](https://attack.mitre.org/groups/G0007). The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[CORESHELL](https://attack.mitre.org/software/S0137) is a downloader used by [APT28](https://attack.mitre.org/groups/G0007). The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)

Labels

malware
12 recorded

Relationships

uses
from APT28
Group
uses
to Ingress Tool Transfer
Technique
uses
to Junk Code Insertion
Technique
uses
to Local Storage Discovery
Technique
uses
to Mail Protocols
Technique
uses
to Obfuscated Files or Information
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Rundll32
Technique
uses
to Standard Encoding
Technique
uses
to Symmetric Cryptography
Technique
uses
to System Information Discovery
Technique
uses
to Web Protocols
Technique
7 external

References

mitre-attack
S0137
open
CORESHELL
—
SOURFACE
—
FireEye APT28 January 2017
https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf
open
FireEye APT28
https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
open
Securelist Sofacy Feb 2018
https://securelist.com/a-slice-of-2017-sofacy-activity/83930/
open
Sofacy
—
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance