prometei_elf | 4ca20f9a4815c5a6c057e5f89c746d97928379ad5261eaf6bfbec1669933d6d6

Analysis

max time kernel
6s
max time network
150s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20241127-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
03/04/2025, 16:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

na.elf
Size

425KB
MD5

57b725def05edfed646ece8be14bf812
SHA1

7060981f5193d39e31665ac846620ca0fa4135e8
SHA256

4ca20f9a4815c5a6c057e5f89c746d97928379ad5261eaf6bfbec1669933d6d6
SHA512

b5948a61026f54d3ddfdb1aa341cb12d1a85186c1d0ecb31fbe205a50f4ecdeb7d9986d752be1dccecf081105790940f3a0a973a0e55b37948c93621d5194980
SSDEEP

6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgK:25WOSACZSV6eKRH5EPiamb4DsDwwca

Score

10^/10

prometei_elf botnet discovery miner persistence privilege_escalation stealer upx

Malware Config

Signatures

Prometei
Prometei is a multiplatform botnet used to mine cryptocurrency.
botnet miner prometei_elf
Prometei_elf family
prometei_elf

Deletes itself 1 IoCs

pid	Process
1387	na.elf

Modifies hosts file 1 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
File opened for modification	/etc/hosts	na.elf

Reads EFI boot settings 1 TTPs 3 IoCs

Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

stealer

Bootkit

T1542.003

description	ioc	Process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/lib/systemd/system/uplugplay.service	na.elf

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/sbin/uplugplay	na.elf

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/16/stat	pidof
File opened for reading	/proc/11/status	pgrep
File opened for reading	/proc/131/cmdline	pgrep
File opened for reading	/proc/1407/cmdline	pgrep
File opened for reading	/proc/8/stat	pidof
File opened for reading	/proc/8/cmdline	pidof
File opened for reading	/proc/957/cmdline	pidof
File opened for reading	/proc/1328/stat	pidof
File opened for reading	/proc/86/cmdline	pidof
File opened for reading	/proc/1332/cmdline	pidof
File opened for reading	/proc/898/cmdline	pgrep
File opened for reading	/proc/72/cmdline	pgrep
File opened for reading	/proc/275/cmdline	pgrep
File opened for reading	/proc/686/cmdline	pgrep
File opened for reading	/proc/903/status	pgrep
File opened for reading	/proc/970/cmdline	pgrep
File opened for reading	/proc/1337/cmdline	pgrep
File opened for reading	/proc/1038/cmdline	pgrep
File opened for reading	/proc/175/stat	pidof
File opened for reading	/proc/169/cmdline	pgrep
File opened for reading	/proc/513/status	pgrep
File opened for reading	/proc/457/cmdline	pidof
File opened for reading	/proc/1227/stat	pidof
File opened for reading	/proc/505/status	pgrep
File opened for reading	/proc/1326/cmdline	pgrep
File opened for reading	/proc/1080/status	pgrep
File opened for reading	/proc/445/status	pgrep
File opened for reading	/proc/566/cmdline	pgrep
File opened for reading	/proc/1050/status	pgrep
File opened for reading	/proc/1113/cmdline	pidof
File opened for reading	/proc/167/stat	pidof
File opened for reading	/proc/1395/status	pgrep
File opened for reading	/proc/898/cmdline	pgrep
File opened for reading	/proc/88/status	pgrep
File opened for reading	/proc/277/status	pgrep
File opened for reading	/proc/77/cmdline	pgrep
File opened for reading	/proc/22/stat	pidof
File opened for reading	/proc/75/stat	pidof
File opened for reading	/proc/1089/cmdline	pgrep
File opened for reading	/proc/70/stat	pidof
File opened for reading	/proc/513/cmdline	pgrep
File opened for reading	/proc/6/stat	pidof
File opened for reading	/proc/1328/cmdline	pgrep
File opened for reading	/proc/274/cmdline	pidof
File opened for reading	/proc/803/cmdline	pgrep
File opened for reading	/proc/1410/cmdline	pgrep
File opened for reading	/proc/924/stat	pidof
File opened for reading	/proc/1461/cmdline	pidof
File opened for reading	/proc/1098/cmdline	pgrep
File opened for reading	/proc/73/stat	pidof
File opened for reading	/proc/158/cmdline	pidof
File opened for reading	/proc/930/stat	pidof
File opened for reading	/proc/1033/cmdline	pidof
File opened for reading	/proc/1079/stat	pidof
File opened for reading	/proc/70/cmdline	pgrep
File opened for reading	/proc/1118/stat	pidof
File opened for reading	/proc/476/status	pgrep
File opened for reading	/proc/1106/status	pgrep
File opened for reading	/proc/164/stat	pidof
File opened for reading	/proc/1059/stat	pidof
File opened for reading	/proc/996/cmdline	pgrep
File opened for reading	/proc/3/cmdline	pidof
File opened for reading	/proc/1135/stat	pidof
File opened for reading	/proc/1364/status	pgrep

/tmp/na.elf
/tmp/na.elf
1⤵
- Deletes itself
- Modifies hosts file
- Modifies systemd
- Write file to user bin folder
PID:1387
- /bin/sh
  sh -c "pgrep na.elf"
  2⤵
  PID:1394
- - /usr/bin/pgrep
    pgrep na.elf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1395
- /bin/sh
  sh -c "pgrep uplugplay"
  2⤵
  PID:1406
- - /usr/bin/pgrep
    pgrep uplugplay
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1407
- /bin/sh
  sh -c "pidof uplugplay"
  2⤵
  PID:1410
- - /usr/bin/pidof
    pidof uplugplay
    3⤵
    - Reads runtime system information
    PID:1411
- /bin/sh
  sh -c "pgrep upnpsetup"
  2⤵
  PID:1420
- - /usr/bin/pgrep
    pgrep upnpsetup
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1421
- /bin/sh
  sh -c "pidof upnpsetup"
  2⤵
  PID:1461
- - /usr/bin/pidof
    pidof upnpsetup
    3⤵
    - Reads runtime system information
    PID:1462
- /bin/sh
  sh -c "systemctl daemon-reload"
  2⤵
  PID:1463
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads EFI boot settings
    PID:1464
- /bin/sh
  sh -c "systemctl enable uplugplay.service"
  2⤵
  PID:1490
- - /usr/bin/systemctl
    systemctl enable uplugplay.service
    3⤵
    - Reads EFI boot settings
    PID:1491
- /bin/sh
  sh -c "systemctl start uplugplay.service"
  2⤵
  PID:1532
- - /usr/bin/systemctl
    systemctl start uplugplay.service
    3⤵
    - Reads EFI boot settings
    PID:1533

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/usr/lib/systemd/system/uplugplay.service

Filesize
145B

MD5
8ca62d1f47880bce036c2956c9b7b272

SHA1
3bcc3a5c4fcc5b0d08c4524a59f6b8e113b62060

SHA256
c655d3d4e374fad38313ec4262207b2d7d68a870238f203ef3c33f85e66c8e32

SHA512
4cd2d9d67151fa25e833707dee2442c4a5f752053fc2c36ec73c0e2b734c66ca69c63fceb47714d9add5b9fe2eee1e45be5199e2cae7c26173e766b333877da6

Download Submit
/usr/sbin/uplugplay

Filesize
425KB

MD5
57b725def05edfed646ece8be14bf812

SHA1
7060981f5193d39e31665ac846620ca0fa4135e8

SHA256
4ca20f9a4815c5a6c057e5f89c746d97928379ad5261eaf6bfbec1669933d6d6

SHA512
b5948a61026f54d3ddfdb1aa341cb12d1a85186c1d0ecb31fbe205a50f4ecdeb7d9986d752be1dccecf081105790940f3a0a973a0e55b37948c93621d5194980

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads