H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

Xbash

[Xbash](https://attack.mitre.org/software/S0341) is a malware family that has targeted Linux and Microsoft Windows servers. The malware has been tied to the Iron Group, a threat actor group known for previous ransomware attacks. [Xbash](https://attack.mitre.org/software/S0341) was developed in Python and then converted into a self-contained Linux ELF executable by using PyInstaller.(Citation: Unit42 Xbash Sept 2018)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[Xbash](https://attack.mitre.org/software/S0341) is a malware family that has targeted Linux and Microsoft Windows servers. The malware has been tied to the Iron Group, a threat actor group known for previous ransomware attacks. [Xbash](https://attack.mitre.org/software/S0341) was developed in Python and then converted into a self-contained Linux ELF executable by using PyInstaller.(Citation: Unit42 Xbash Sept 2018)

Labels

malware
16 recorded

Relationships

uses
to Cron
Technique
uses
to Data Destruction
Technique
uses
to Data Encrypted for Impact
Technique
uses
to Dead Drop Resolver
Technique
uses
to Exploitation for Client Execution
Technique
uses
to Ingress Tool Transfer
Technique
uses
to JavaScript
Technique
uses
to Mshta
Technique
uses
to Network Service Discovery
Technique
uses
to Password Guessing
Technique
uses
to PowerShell
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Regsvr32
Technique
uses
to System Network Configuration Discovery
Technique
uses
to Visual Basic
Technique
uses
to Web Protocols
Technique
3 external

References

mitre-attack
S0341
open
Xbash
—
Unit42 Xbash Sept 2018
https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance