General

  • Target

    6c9315c6a12455c3f972f3b1855a97dcaa31b9e485cd280ff4b1f9875744ff35.elf

  • Size

    418KB

  • Sample

    250221-ds7kaa1ngt

  • MD5

    d722f68eb6434a174f71ab93de29f390

  • SHA1

    1d65a50bbed4f27052fd915602ae02530b59fea8

  • SHA256

    6c9315c6a12455c3f972f3b1855a97dcaa31b9e485cd280ff4b1f9875744ff35

  • SHA512

    1b54cf7f8eb7e3b50caeb16f7baba6c075800feafc75643659f4ae9c70321f0c6b0863ec65a74a254da71f3249b6b5f45deb3de96b83d974bab36c3d531509d6

  • SSDEEP

    12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSr:W4/y+qaBUZJAdVt/

Malware Config

Targets

    • Target

      6c9315c6a12455c3f972f3b1855a97dcaa31b9e485cd280ff4b1f9875744ff35.elf

    • Size

      418KB

    • MD5

      d722f68eb6434a174f71ab93de29f390

    • SHA1

      1d65a50bbed4f27052fd915602ae02530b59fea8

    • SHA256

      6c9315c6a12455c3f972f3b1855a97dcaa31b9e485cd280ff4b1f9875744ff35

    • SHA512

      1b54cf7f8eb7e3b50caeb16f7baba6c075800feafc75643659f4ae9c70321f0c6b0863ec65a74a254da71f3249b6b5f45deb3de96b83d974bab36c3d531509d6

    • SSDEEP

      12288:6QIkwT+V+46MTuxN+qpMBUH5kAAxwWVtBeSr:W4/y+qaBUZJAdVt/

    • Prometei

      Prometei is a multiplatform botnet used to mine cryptocurrency.

    • Prometei_elf family

    • Deletes itself

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

    • Write file to user bin folder

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks