Xbash Ransomware, Botnet Malware Sample

Xbash is a unique malware that is a ransomware, botnet, a worm and a XMR crypto currency miner at same time. What distinguish it from normal every day malware is that it has the ability to execute on Windows and Linux alike. Xbash has capabilities of a worm so does not reply on phishing emails. Xbash is credited to Iron Group.

Xbash Windows Sample 1 Signatures

Family: HEUR:Trojan-Downloader.Script.Generic
MD5: 3b5baecd61190e12a526c51d5ecccbbe
SHA256: f888dda9ca1876eba12ffb55a7a993bd1f5a622a30045a675da4955ede3e4cb8

Xbash Windows Sample 1 Download

Xbash Windows Sample 2 Signatures

Family: Win32:Malware-gen
MD5: 3a3ae909caee915af927c29a6025d16c
SHA256: 31155bf8c85c6c6193842b8d09bda88990d710db9f70efe85c421f1484f0ee78

Xbash Windows Sample 2 Download

Xbash Windows Sample 3 Signatures

Family: HEUR:Trojan-Downloader.Script.Generic
MD5: 3b5baecd61190e12a526c51d5ecccbbe
SHA256: f888dda9ca1876eba12ffb55a7a993bd1f5a622a30045a675da4955ede3e4cb8

Xbash Windows Sample 3 Download

Xbash Linux Sample 1 Signatures

Family: BV:Miner-X [Drp]
MD5: 9d080aa27da74e146a45b56c86476f20
SHA256: dcd37e5b266cc0cd3fab73caa63b218f5b92e9bd5b25cf1cacf1afdb0d8e76ff

Xbash Linux Sample 1 Download

Xbash Linux Sample 2 Signatures

Family: ELF:Agent-SX [Trj]
MD5: 55142f1d393c5ba7405239f232a6c059
SHA256: e59be6eec9629d376a8a4a70fe9f8f3eec7b0919019f819d44b9bdd1c429277c

Xbash Linux Sample 2 Download