General

  • Target

    na.elf

  • Size

    425KB

  • Sample

    250312-lb2ayavlx3

  • MD5

    0132aee82e5e566de71f26472eba04e6

  • SHA1

    79caedc4ecc7391316fd6a587723ff2ae8a55a39

  • SHA256

    712e88fff9d4c73407e626e3c18bbbc740c7aa7fdcc489a06a74990471784b00

  • SHA512

    921247d9c77531529deba4c3aa35bd21b472e5698e0392eaf5d88d4eb4443b69260092872b082f12ab1b65aef4167e57a7a8338d949a8a31c69a86e763678584

  • SSDEEP

    6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgh:25WOSACZSV6eKRH5EPiamb4DsDwwcx

Malware Config

Targets

    • Target

      na.elf

    • Size

      425KB

    • MD5

      0132aee82e5e566de71f26472eba04e6

    • SHA1

      79caedc4ecc7391316fd6a587723ff2ae8a55a39

    • SHA256

      712e88fff9d4c73407e626e3c18bbbc740c7aa7fdcc489a06a74990471784b00

    • SHA512

      921247d9c77531529deba4c3aa35bd21b472e5698e0392eaf5d88d4eb4443b69260092872b082f12ab1b65aef4167e57a7a8338d949a8a31c69a86e763678584

    • SSDEEP

      6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgh:25WOSACZSV6eKRH5EPiamb4DsDwwcx

    • Prometei

      Prometei is a multiplatform botnet used to mine cryptocurrency.

    • Prometei_elf family

    • Deletes itself

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

    • Write file to user bin folder

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks