Xbash
Software · ATTACK:enterprise:S0341
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0341",
"title": "Xbash",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0341",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--6a92d80f-cc65-45f6-aa66-3cdea6786b3c",
"external_id": "S0341",
"domain": "enterprise",
"created": "2019-01-30T13:28:47.452Z",
"modified": "2025-04-25T14:43:40.462Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Xbash"
},
{
"source_name": "Unit42 Xbash Sept 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06eac254-32a7-4e32-97b2-c46f79b4adb3
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c8208ad-b295-4e39-a928-40fc49f68fb4
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21117898-adc0-41c1-9e2e-2551e638ef71
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1218.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ed3ed76-7ebe-4371-a7e9-cc5a45ace915
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3341ad26-c7a8-4e42-a095-a49e65fde843
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1053.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52c32b71-1b7c-45e9-b082-7f3f16b90f2b
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6706d89e-27dd-48bb-ae0b-db51e07cbc91
Unit42 Xbash Sept 2018 · Trend Micro Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--809ffec1-52a1-45a5-b410-049352b99700
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a8068fb-7cf9-4ab6-92a7-e8b3ecdf578d
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1059.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dd45f3b-a005-40b3-a6ef-c1ef208e8504
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9409dcff-0ddf-43f6-b7c0-937fd9216ee0
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98ccbadd-dbfa-44d3-b3f2-3a55c8fa37e1
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1110.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9de3c2d-1b2e-4c35-a406-475f5f5fd4d5
Unit42 Xbash Sept 2018 · Trend Micro Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee9da7e8-12a5-4b77-84ce-a5453874a070
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5548cf6-d6d8-401e-997c-ee72642d691c
Unit42 Xbash Sept 2018ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1102.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc56f0e8-e059-403a-88e4-bd0b61bbc4b7
Unit42 Xbash Sept 2018