Xbash

ATP Sandbox Adv. HeuristicsNetskope IPS

Stats

First seen: February 2022
Last seen: September 2026

MITRE ATT&CK techniques

16 techniques across 7 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.003Cron
T1059Command and Scripting Interpreter
- T1059.005Visual Basic
- T1059.001PowerShell
- T1059.007JavaScript
T1203Exploitation for Client Execution

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1218System Binary Proxy Execution
- T1218.005Mshta
- T1218.010Regsvr32

TA0006 Credential Access

T1110Brute Force
- T1110.001Password Guessing

TA0007 Discovery

T1016System Network Configuration Discovery
T1046Network Service Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1102Web Service
- T1102.001Dead Drop Resolver
T1105Ingress Tool Transfer

TA0040 Impact

T1485Data Destruction
T1486Data Encrypted for Impact

Alert name variants

Alert Name	Engine
Linux.Ransomware.Xbash	ATP Sandbox Adv. Heuristics
Linux.Trojan.Xbash	ATP Sandbox Adv. Heuristics
Win32.Trojan.Xbash	ATP Sandbox Adv. Heuristics
Win64.Trojan.Xbash	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-OTHER Img.Trojan.Xbash variant PNG file with an embedded Windows executable	IPS-SWG

Related families

Cobalt Strike QakBot Astaroth Emotet InvisiMole