Unit42 Xbash Sept 2018

Xbash can collect IP addresses and local intranet information from a victim’s machine.

Xbash can perform port scanning of TCP and UDP ports.

Xbash can create a cronjob for persistence if it determines it is on a Linux system.

Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.

Xbash can execute malicious VBScript payloads on the victim’s machine.

Xbash can execute malicious JavaScript payloads on the victim’s machine.

Xbash uses HTTP for C2 communications.

Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.

Xbash can download additional malicious files from its C2 server.

Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.

Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.

Xbash can use mshta for executing scripts.

Xbash can use regsvr32 for executing scripts.

Xbash has destroyed Linux-based databases as part of its ransomware capabilities.

Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.

Xbash can create a Startup item for persistence if it determines it is on a Windows system.