General

  • Target

    na.elf

  • Size

    425KB

  • Sample

    250312-m716gsysf1

  • MD5

    2bedeb83ae07f9d7f3e1fc1a57fa51b3

  • SHA1

    7dc456d50c22e3d56af361ac4a888102cb5ead5a

  • SHA256

    0e3c21eccf437e0c8d3f768e16b345e612c23d5895d8f39a141ce7a2fb73f2aa

  • SHA512

    4bc78798493a4269b8024f45646ffc6a1811a6fe18a93d307a2918c151a22b9abec59bc8eec57c3135a960a9009e2f8ffcbabb8cf87de468658945e015a35d65

  • SSDEEP

    6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgS:25WOSACZSV6eKRH5EPiamb4DsDwwcC

Malware Config

Targets

    • Target

      na.elf

    • Size

      425KB

    • MD5

      2bedeb83ae07f9d7f3e1fc1a57fa51b3

    • SHA1

      7dc456d50c22e3d56af361ac4a888102cb5ead5a

    • SHA256

      0e3c21eccf437e0c8d3f768e16b345e612c23d5895d8f39a141ce7a2fb73f2aa

    • SHA512

      4bc78798493a4269b8024f45646ffc6a1811a6fe18a93d307a2918c151a22b9abec59bc8eec57c3135a960a9009e2f8ffcbabb8cf87de468658945e015a35d65

    • SSDEEP

      6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgS:25WOSACZSV6eKRH5EPiamb4DsDwwcC

    • Prometei

      Prometei is a multiplatform botnet used to mine cryptocurrency.

    • Prometei_elf family

    • Deletes itself

    • Modifies hosts file

      Adds to hosts file used for mapping hosts to IP addresses.

    • Enumerates running processes

      Discovers information about currently running processes on the system

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

    • Write file to user bin folder

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks