New Xbash Malware a Cocktail of Malicious Functions

Adding to the rapidly growing list of multi-functional malware, a particularly nasty – and unique — data-destroying malware tool has been discovered that combines botnet, coin mining, ransomware, and self-propagation capabilities.

The malware, which researchers at Palo Alto Network's Unit 42 group has named Xbash, is targeting Linux and Windows servers and contains capabilities that when fully implemented can help it spread very quickly inside an organization's network.

Researchers from Palo Alto Network say their analysis shows the malware is being used to target Linux servers for their ransomware and botnet capabilities, and Windows servers for coin mining and self-propagation purposes.

Xbash's ransomware capabilities are designed to target and delete Linux-based databases. Worse, the malware appears to contain no functionality at all for helping victims recover lost data in the event they end up paying the demanded ransom.

So far, at least 48 victims have paid a total of $6,000 to the attackers, but there is no evidence that any of them were able to recover data that Xbash might have deleted, Palo Alto Networks said in an advisory Monday.

"Taken as a whole, we've not [before] seen this combination of ransomware, coinmining, worm capabilities, and targeting both Linux and Windows systems," says Ryan Olson, vice president of threat intelligence at Unit 42.

The malware appears to be the work of Iron Group, a threat actor associated with previous ransomware attacks and for spreading cryptocurrency mining tools mostly in Windows environments. With Xbash, the group appears to have broadened their targets to include Linux systems as well.

Unlike other recent Linux malware such as Gafgyt and Mirai, which scan for vulnerable devices using randomly generated IP addresses, Xbash scans for them also by domain name. The capability makes it harder for defenders to spot Xbash using honeypots, which are typically deployed with IP addresses only.

"Xbash uses a list of IP addresses and domains provided by its C2 to scan for specific open ports, weak credentials, or three known vulnerabilities in Hadoop, Redis and ActiveMQ — which it uses for self-propagation," Olson notes.

Two of the three vulnerabilities have no formal CVE number assigned to them. One of them is an unauthenticated command execution flaw in Hadoop YARN that was first disclosed in October 2016; the Redis flaw is from October 2015 and gives attackers a way to remotely execute files of their choice on a target machine. The third-flaw — n Active MQ — enables arbitrary file writes and has an assigned CVE number (CVE-2016-3088).

When it is exploiting a vulnerable Redis instance, Xbash is capable of determining whether it is running on a Windows system so the malware can then download and execute a coinminer it.

If the target that Xbash is scanning happens to be an IP address, it tries to scan multiple UDP and TCP ports. Among them are ports used by HTTP services, VMC, MySQL, Telnet, FTP, NTP, DNS and LDAP. If certain ports happen to be open—such as those used by VNC, MySQL and PostgreSQL—the malware uses a weak username and password dictionary—to brute force its way into the service.

 "Xbash uses weak passwords in its attacks against both Windows systems and Linux services," Olson says. "It uses both a built-in dictionary and also updates from its C2 server with an additional set of weak passwords."

When Xbash breaks into a service such as MySQL or MongoDB, it immediately deletes almost all the databases on the server and serves up a ransom message. "Because the malware deletes the databases based on brute forcing weak credentials for specific services, it could also happen on Windows with the same open ports/services and weak credentials," Olson warns.

Shades of WannaCry, NotPetya

The samples of Xbash that researchers at Palo Alto Networks analyzed show that the authors of Xbash are developing a new capability that will let the malware scan infected networks for other vulnerable servers. The capability has not yet been enabled, but if it is, Xbash will be able to spread quickly within an infected network like the WannaCray and Petya/NotPetya ransomware did.

For organizations, multi-functional and highly modular malware tools are quickly becoming a new threat. In recent weeks, several security vendors have issued warnings about malware tools capable of carrying out multiple malicious functions or of being modified after installation to do different things.

Proofpoint, for instance, recently warned about AdvisorsBot and Marap, two modular tools that allow criminals to add new functions to malware that has already been installed on a system. In an August advisory, Kaspersky Lab said it had observed a near doubling of multipurpose Remote Access Tools being distributed via botnets over the past 18 months or so, from 6.5% to 12.2%.

The trend highlights the need for a more high-level approach to defending against threats. "Organizations and defenders are better off focusing on prevention than specific threats," Olson notes. "A threat-based approach against Xbash would require multiple threats against multiple vectors, which is not scalable and is inherently advantageous to the attackers."

Related Content:

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.