prometei_elf | 037289c207c8e229d728f247c2d7eb1459fb4413fcd4fe662f74c711169a1e08

Analysis

max time kernel
6s
max time network
8s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20240611-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20240611-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
20/03/2025, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

void/72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf
Size

425KB
MD5

841f9057c3afebc6891904d6c336c8d6
SHA1

3200284f8e23c5179adef69a6e199225ad782b69
SHA256

72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de
SHA512

ddd922538baaaff054c1b42e146a9ef813200cce10ec5ca4a21e386c49e54c1555c4c34e35ea0ed2ada138fb42f8a334eef72f11414c82a4bcfa165078d3cd12
SSDEEP

6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgb:25WOSACZSV6eKRH5EPiamb4DsDwwcr

Score

10^/10

prometei_elf botnet discovery miner persistence privilege_escalation stealer upx

Malware Config

Signatures

Prometei
Prometei is a multiplatform botnet used to mine cryptocurrency.
botnet miner prometei_elf
Prometei_elf family
prometei_elf

Deletes itself 1 IoCs

pid	Process
1438	72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf

Modifies hosts file 1 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
File opened for modification	/etc/hosts	72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf

Reads EFI boot settings 1 TTPs 3 IoCs

Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

stealer

Bootkit

T1542.003

description	ioc	Process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/lib/systemd/system/uplugplay.service	72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/sbin/uplugplay	72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral15/files/fstream-1.dat	upx

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1347/cmdline	pgrep
File opened for reading	/proc/90/cmdline	pidof
File opened for reading	/proc/1075/stat	pidof
File opened for reading	/proc/573/cmdline	pgrep
File opened for reading	/proc/174/cmdline	pgrep
File opened for reading	/proc/578/cmdline	pidof
File opened for reading	/proc/394/status	pgrep
File opened for reading	/proc/1335/cmdline	pidof
File opened for reading	/proc/13/cmdline	pidof
File opened for reading	/proc/533/cmdline	pidof
File opened for reading	/proc/394/cmdline	pgrep
File opened for reading	/proc/165/cmdline	pidof
File opened for reading	/proc/264/stat	pidof
File opened for reading	/proc/92/cmdline	pgrep
File opened for reading	/proc/1344/status	pgrep
File opened for reading	/proc/496/cmdline	pgrep
File opened for reading	/proc/573/cmdline	pgrep
File opened for reading	/proc/81/stat	pidof
File opened for reading	/proc/942/cmdline	pgrep
File opened for reading	/proc/174/cmdline	pgrep
File opened for reading	/proc/942/cmdline	pgrep
File opened for reading	/proc/6/cmdline	pidof
File opened for reading	/proc/634/cmdline	pgrep
File opened for reading	/proc/74/cmdline	pidof
File opened for reading	/proc/669/cmdline	pgrep
File opened for reading	/proc/70/status	pgrep
File opened for reading	/proc/78/cmdline	pidof
File opened for reading	/proc/1334/status	pgrep
File opened for reading	/proc/1062/cmdline	pidof
File opened for reading	/proc/1340/status	pgrep
File opened for reading	/proc/77/cmdline	pgrep
File opened for reading	/proc/105/status	pgrep
File opened for reading	/proc/159/stat	pidof
File opened for reading	/proc/669/cmdline	pidof
File opened for reading	/proc/832/cmdline	pgrep
File opened for reading	/proc/581/stat	pidof
File opened for reading	/proc/1078/stat	pidof
File opened for reading	/proc/242/cmdline	pgrep
File opened for reading	/proc/981/status	pgrep
File opened for reading	/proc/654/stat	pidof
File opened for reading	/proc/164/cmdline	pidof
File opened for reading	/proc/1119/cmdline	pidof
File opened for reading	/proc/873/status	pgrep
File opened for reading	/proc/1349/status	pgrep
File opened for reading	/proc/454/stat	pidof
File opened for reading	/proc/1179/status	pgrep
File opened for reading	/proc/164/cmdline	pidof
File opened for reading	/proc/946/stat	pidof
File opened for reading	/proc/1021/status	pgrep
File opened for reading	/proc/17/cmdline	pidof
File opened for reading	/proc/173/stat	pidof
File opened for reading	/proc/85/cmdline	pidof
File opened for reading	/proc/1031/status	pgrep
File opened for reading	/proc/176/cmdline	pidof
File opened for reading	/proc/1341/cmdline	pgrep
File opened for reading	/proc/167/cmdline	pidof
File opened for reading	/proc/242/status	pgrep
File opened for reading	/proc/1076/cmdline	pidof
File opened for reading	/proc/163/cmdline	pgrep
File opened for reading	/proc/105/stat	pidof
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/821/cmdline	pidof
File opened for reading	/proc/1021/cmdline	pgrep
File opened for reading	/proc/1106/cmdline	pgrep

/tmp/void/72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf
/tmp/void/72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf
1⤵
- Deletes itself
- Modifies hosts file
- Modifies systemd
- Write file to user bin folder
PID:1438
- /bin/sh
  sh -c "pgrep 72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf"
  2⤵
  PID:1441
- - /usr/bin/pgrep
    pgrep 72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1442
- /bin/sh
  sh -c "pidof 72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf"
  2⤵
  PID:1449
- - /usr/bin/pidof
    pidof 72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de.elf
    3⤵
    - Reads runtime system information
    PID:1450
- /bin/sh
  sh -c "pgrep uplugplay"
  2⤵
  PID:1453
- - /usr/bin/pgrep
    pgrep uplugplay
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1454
- /bin/sh
  sh -c "pidof uplugplay"
  2⤵
  PID:1457
- - /usr/bin/pidof
    pidof uplugplay
    3⤵
    - Reads runtime system information
    PID:1458
- /bin/sh
  sh -c "pgrep upnpsetup"
  2⤵
  PID:1461
- - /usr/bin/pgrep
    pgrep upnpsetup
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1462
- /bin/sh
  sh -c "pidof upnpsetup"
  2⤵
  PID:1465
- - /usr/bin/pidof
    pidof upnpsetup
    3⤵
    - Reads runtime system information
    PID:1466
- /bin/sh
  sh -c "systemctl daemon-reload"
  2⤵
  PID:1468
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads EFI boot settings
    PID:1469
- /bin/sh
  sh -c "systemctl enable uplugplay.service"
  2⤵
  PID:1495
- - /usr/bin/systemctl
    systemctl enable uplugplay.service
    3⤵
    - Reads EFI boot settings
    PID:1496
- /bin/sh
  sh -c "systemctl start uplugplay.service"
  2⤵
  PID:1537
- - /usr/bin/systemctl
    systemctl start uplugplay.service
    3⤵
    - Reads EFI boot settings
    PID:1538

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/usr/lib/systemd/system/uplugplay.service

Filesize
145B

MD5
8ca62d1f47880bce036c2956c9b7b272

SHA1
3bcc3a5c4fcc5b0d08c4524a59f6b8e113b62060

SHA256
c655d3d4e374fad38313ec4262207b2d7d68a870238f203ef3c33f85e66c8e32

SHA512
4cd2d9d67151fa25e833707dee2442c4a5f752053fc2c36ec73c0e2b734c66ca69c63fceb47714d9add5b9fe2eee1e45be5199e2cae7c26173e766b333877da6

Download Submit
/usr/sbin/uplugplay

Filesize
425KB

MD5
841f9057c3afebc6891904d6c336c8d6

SHA1
3200284f8e23c5179adef69a6e199225ad782b69

SHA256
72cb96390164439710b0ab64f8b0e211d49875a0f4ea402da22a0269794891de

SHA512
ddd922538baaaff054c1b42e146a9ef813200cce10ec5ca4a21e386c49e54c1555c4c34e35ea0ed2ada138fb42f8a334eef72f11414c82a4bcfa165078d3cd12

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads