S0137CORESHELL

[CORESHELL](https://attack.mitre.org/software/S0137) is a downloader used by [APT28](https://attack.mitre.org/groups/G0007). The older versions of this malware are known as SOURFACE and newer versions as CORESHELL.(Citation: FireEye APT28) (Citation: FireEye APT28 January 2017) Documented platforms: Windows. Attributed to ATT&CK group: APT28. Catalogued in ATT&CK 14.1. 4 references curated.