TF-MAL-elf.xbash

Description

ThreatFox malware family `elf.xbash`. Printable name: Xbash.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Xbash, Software S0341 | MITRE ATT&CK®
  web:attack.mitre.org

  Xbash is a malware family that has targeted Linux and Microsoft Windows servers. The malware has been tied to the Iron Group, a threat actor group known for previous ransomware attacks.

  2026-05-22 05:24 UTC
• GitHub - anubhavanonymous/Xbash: XBash Malware files
  web:github.com

  Unit 42 researchers have found a new malware family that is targeting Linux and Microsoft Windows servers. We can tie this malware , which we have named Xbash , to the Iron Group, a threat actor group known for previous ransomware attacks.> Xbash has ransomware and coinmining capabilities. It also has self-propagating capabilities (meaning it has worm-like characteristics similar to WannaCry or ...

  2026-05-22 05:24 UTC
• The Database Slayer: Deep Dive and Simulation of the Xbash Malware
  web:imtr.net

  - YARA rules: [Not specified in the article] ## Mitigation Strategies - **Database Hardening:** Addressing specific weaknesses like weak passwords, misconfigurations, and disabled security features on targeted database systems. - **Network Segmentation:** Limiting network exposure of database servers.

  2026-05-22 05:24 UTC
• Xbash (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the Xbash malware family including references, samples and yara signatures.

  2026-05-22 05:24 UTC
• Xbash combines botnet, ransomware and cryptomining techniques for ...
  web:optocrypto.com

  The publication says it is a new malware family associated with the Iron Group of hackers known for their past ransomware attacks. However, Xbash has shown a much more complex attack vector, combining the exploitation of multiple vulnerabilities and weak passwords.

  2026-05-22 05:24 UTC
• New Version of Xbash Malware Targets Cloud Security Programs
  web:solutionsreview.com

  Threat actor group Rocke, apparently associated with the Iron cybercrime group, developed Xbash and this latest malware . Unit 42's report on the new malware revealed that it was capable of removing cloud security products from the user's computer. Specifically, it can deactivate programs released by Tencent Cloud and Alibaba Cloud.

  2026-05-22 05:24 UTC
• Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets ...
  web:unit42.paloaltonetworks.com

  Executive Summary: Unit 42 researchers have found a new malware family that is targeting Linux and Microsoft Windows servers that we have named XBash . We can tie this malware to the Iron Group, a threat actor group known for ransomware attacks in the past. Xbash has ransomware and coinmining capabilities. It also has self-propagating capabilities (meaning it has worm-like characteristics ...

  2026-05-22 05:24 UTC
• XBash Malware Deletes Database and Mines for Cryptocurrency
  web:www.iobit.com

  Days ago, a newly discovered malware named Xbash was reported to have combined ransomware, coinminer, botnet and worm feature together, according to the research from Palo Alto Networks. Xbash is named based on the name of the malicious code's original main module. The malware attacks both Windows and Linux systems in different ways. It deletes database on Linux while mines for crypto ...

  2026-05-22 05:24 UTC
• The Database Slayer: Deep Dive and Simulation of the Xbash Malware
  web:www.levelblue.com

  However, the focus will be on the database attack component of the Xbash malware . Xbash Overview Xbash is a multifaceted malware with capabilities ranging from database ransomware, botnet capabilities, cryptomining, and self-propagation. By leveraging its botnet traits, Xbash can recruit infected systems to execute further attacks.

  2026-05-22 05:24 UTC
• Destructive Xbash Linux Malware Targets Enterprise Intranets
  web:www.securityweek.com

  A newly discovered piece of Linux malware that features both ransomware and crypto-currency mining capabilities appears designed to target enterprise intranets, Palo Alto Networks security researchers say. Dubbed Xbash and believed to be tied to the Iron Group, a threat actor known for previous ransomware attacks, the malware can target both Linux and Windows servers. It contains a Python ...

  2026-05-22 05:24 UTC

Only Available for Registered Users. Sign in to view.