prometei_elf | fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6

Analysis

max time kernel
6s
max time network
132s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240508-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240508-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
18-02-2025 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf
Size

418KB
MD5

311b7bae7f13aa9b4d2b70c4fe84f2bd
SHA1

9be00b05f6dacd5fe63347e4981b0ba01b96b8c1
SHA256

fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6
SHA512

8105a829cf596c4aa6f6447fc43572ee7d9f1eaae30331c69df2fe538d405e19148bc88b870084e1370d17ce25f7c1fa8845a132bd3bbc967a9eec4e2b27259d
SSDEEP

12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSd:W4/y+qaBUZJAdVtZ

Score

10^/10

prometei_elf botnet discovery miner persistence privilege_escalation stealer upx

Malware Config

Signatures

Prometei
Prometei is a multiplatform botnet used to mine cryptocurrency.
botnet miner prometei_elf
Prometei_elf family
prometei_elf

Deletes itself 1 IoCs

pid	Process
1395	fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf

Modifies hosts file 1 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
File opened for modification	/etc/hosts	fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf

Reads EFI boot settings 1 TTPs 3 IoCs

Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

stealer

Bootkit

T1542.003

description	ioc	Process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/lib/systemd/system/uplugplay.service	fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/sbin/uplugplay	fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/102/cmdline	pidof
File opened for reading	/proc/669/stat	pidof
File opened for reading	/proc/201/status	pgrep
File opened for reading	/proc/1185/cmdline	pgrep
File opened for reading	/proc/557/stat	pidof
File opened for reading	/proc/1337/cmdline	pidof
File opened for reading	/proc/90/cmdline	pidof
File opened for reading	/proc/93/cmdline	pidof
File opened for reading	/proc/440/cmdline	pgrep
File opened for reading	/proc/162/stat	pidof
File opened for reading	/proc/1024/cmdline	pgrep
File opened for reading	/proc/957/cmdline	pidof
File opened for reading	/proc/1071/cmdline	pidof
File opened for reading	/proc/483/status	pgrep
File opened for reading	/proc/7/cmdline	pidof
File opened for reading	/proc/671/cmdline	pidof
File opened for reading	/proc/993/stat	pidof
File opened for reading	/proc/1019/cmdline	pgrep
File opened for reading	/proc/1449/cmdline	pidof
File opened for reading	/proc/22/status	pgrep
File opened for reading	/proc/1110/stat	pidof
File opened for reading	/proc/105/stat	pidof
File opened for reading	/proc/533/stat	pidof
File opened for reading	/proc/90/cmdline	pidof
File opened for reading	/proc/169/cmdline	pidof
File opened for reading	/proc/13/cmdline	pidof
File opened for reading	/proc/72/cmdline	pidof
File opened for reading	/proc/23/status	pgrep
File opened for reading	/proc/177/cmdline	pgrep
File opened for reading	/proc/1077/status	pgrep
File opened for reading	/proc/201/stat	pidof
File opened for reading	/proc/1395/stat	pidof
File opened for reading	/proc/17/status	pgrep
File opened for reading	/proc/270/cmdline	pidof
File opened for reading	/proc/946/cmdline	pidof
File opened for reading	/proc/825/status	pgrep
File opened for reading	/proc/21/stat	pidof
File opened for reading	/proc/1060/cmdline	pidof
File opened for reading	/proc/535/stat	pidof
File opened for reading	/proc/1355/cmdline	pidof
File opened for reading	/proc/1101/stat	pidof
File opened for reading	/proc/86/stat	pidof
File opened for reading	/proc/165/status	pgrep
File opened for reading	/proc/496/cmdline	pidof
File opened for reading	/proc/497/status	pgrep
File opened for reading	/proc/1344/status	pgrep
File opened for reading	/proc/497/stat	pidof
File opened for reading	/proc/638/cmdline	pidof
File opened for reading	/proc/454/stat	pidof
File opened for reading	/proc/1200/stat	pidof
File opened for reading	/proc/638/cmdline	pgrep
File opened for reading	/proc/929/stat	pidof
File opened for reading	/proc/78/cmdline	pidof
File opened for reading	/proc/394/stat	pidof
File opened for reading	/proc/691/cmdline	pidof
File opened for reading	/proc/1341/status	pgrep
File opened for reading	/proc/1097/cmdline	pidof
File opened for reading	/proc/691/status	pgrep
File opened for reading	/proc/84/cmdline	pidof
File opened for reading	/proc/444/cmdline	pgrep
File opened for reading	/proc/84/cmdline	pidof
File opened for reading	/proc/1019/cmdline	pidof
File opened for reading	/proc/454/cmdline	pgrep
File opened for reading	/proc/1347/status	pgrep

/tmp/fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf
/tmp/fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf
1⤵
- Deletes itself
- Modifies hosts file
- Modifies systemd
- Write file to user bin folder
PID:1395
- /bin/sh
  sh -c "pgrep fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf"
  2⤵
  PID:1398
- - /usr/bin/pgrep
    pgrep fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1399
- /bin/sh
  sh -c "pidof fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf"
  2⤵
  PID:1441
- - /usr/bin/pidof
    pidof fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6.elf
    3⤵
    - Reads runtime system information
    PID:1442
- /bin/sh
  sh -c "pgrep uplugplay"
  2⤵
  PID:1445
- - /usr/bin/pgrep
    pgrep uplugplay
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1446
- /bin/sh
  sh -c "pidof uplugplay"
  2⤵
  PID:1449
- - /usr/bin/pidof
    pidof uplugplay
    3⤵
    - Reads runtime system information
    PID:1450
- /bin/sh
  sh -c "pgrep upnpsetup"
  2⤵
  PID:1453
- - /usr/bin/pgrep
    pgrep upnpsetup
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1454
- /bin/sh
  sh -c "pidof upnpsetup"
  2⤵
  PID:1457
- - /usr/bin/pidof
    pidof upnpsetup
    3⤵
    - Reads runtime system information
    PID:1458
- /bin/sh
  sh -c "systemctl daemon-reload"
  2⤵
  PID:1460
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads EFI boot settings
    PID:1461
- /bin/sh
  sh -c "systemctl enable uplugplay.service"
  2⤵
  PID:1500
- - /usr/bin/systemctl
    systemctl enable uplugplay.service
    3⤵
    - Reads EFI boot settings
    PID:1501
- /bin/sh
  sh -c "systemctl start uplugplay.service"
  2⤵
  PID:1529
- - /usr/bin/systemctl
    systemctl start uplugplay.service
    3⤵
    - Reads EFI boot settings
    PID:1530

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/usr/lib/systemd/system/uplugplay.service

Filesize
145B

MD5
8ca62d1f47880bce036c2956c9b7b272

SHA1
3bcc3a5c4fcc5b0d08c4524a59f6b8e113b62060

SHA256
c655d3d4e374fad38313ec4262207b2d7d68a870238f203ef3c33f85e66c8e32

SHA512
4cd2d9d67151fa25e833707dee2442c4a5f752053fc2c36ec73c0e2b734c66ca69c63fceb47714d9add5b9fe2eee1e45be5199e2cae7c26173e766b333877da6

Download Submit
/usr/sbin/uplugplay

Filesize
418KB

MD5
311b7bae7f13aa9b4d2b70c4fe84f2bd

SHA1
9be00b05f6dacd5fe63347e4981b0ba01b96b8c1

SHA256
fd7140e4cbaa38bc0bca315eac9bfe2cfbe33f629961862b4c21d88e478a14b6

SHA512
8105a829cf596c4aa6f6447fc43572ee7d9f1eaae30331c69df2fe538d405e19148bc88b870084e1370d17ce25f7c1fa8845a132bd3bbc967a9eec4e2b27259d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads