CORESHELL

Malware & Tools · CORESHELL

· MalwareS0137 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

CORESHELL is a downloader used by APT28. The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017)

Tactic Coverage

command and control (5)stealth (3)discovery (2)persistence (1)privilege escalation (1)

Used By (1 groups)

G0007APT28IRON TWILIGHT, SNAKEMACKEREL

Techniques (11)

T1027Obfuscated Files or Information

stealth

T1027.016Junk Code Insertion

stealth

T1071.001Web Protocols

command and control

T1071.003Mail Protocols

command and control

T1082System Information Discovery

discovery

T1105Ingress Tool Transfer

command and control

T1132.001

References

https://attack.mitre.org/software/S0137 https://www.mandiant.com/sites/default/files/2021-09/APT28-Center-of-Storm-2017.pdf https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf https://securelist.com/a-slice-of-2017-sofacy-activity/83930/