prometei_elf | 810ac12f80c1bc3ca3dd00f912e7f801ea3e5fc3471c0365bec4df77c4773579 | Triage

Sharing

General

Target

na.elf
Size

425KB
Sample

250404-cmv4max1dx
MD5

19d824d294f64ad6b4c0848ea258c86b
SHA1

a763d82e3fe2ff49417496bde93cd1f4d83aeb4c
SHA256

810ac12f80c1bc3ca3dd00f912e7f801ea3e5fc3471c0365bec4df77c4773579
SHA512

fb5e6e4ede1f8058a9a5d084392d625b05a083c6ac901a7c0cc8de0937c2d31ac1032fc6b4b9270f9b805dd38f53a47991dcfe8bb8d7aeac4f71b0223ea5cc97
SSDEEP

6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgh:25WOSACZSV6eKRH5EPiamb4DsDwwcR

Score

10^/10

prometei_elf botnet discovery linux miner persistence privilege_escalation upx

Malware Config

Targets

- Target
  
  na.elf
- Size
  
  425KB
- MD5
  
  19d824d294f64ad6b4c0848ea258c86b
- SHA1
  
  a763d82e3fe2ff49417496bde93cd1f4d83aeb4c
- SHA256
  
  810ac12f80c1bc3ca3dd00f912e7f801ea3e5fc3471c0365bec4df77c4773579
- SHA512
  
  fb5e6e4ede1f8058a9a5d084392d625b05a083c6ac901a7c0cc8de0937c2d31ac1032fc6b4b9270f9b805dd38f53a47991dcfe8bb8d7aeac4f71b0223ea5cc97
- SSDEEP
  
  6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgh:25WOSACZSV6eKRH5EPiamb4DsDwwcR
Score

10^/10

prometei_elf botnet discovery miner persistence privilege_escalation upx
- Prometei
  Prometei is a multiplatform botnet used to mine cryptocurrency.
  botnet miner prometei_elf
- Prometei_elf family
  prometei_elf
- Deletes itself
- Modifies hosts file
  Adds to hosts file used for mapping hosts to IP addresses.
- Enumerates running processes
  Discovers information about currently running processes on the system
- Modifies systemd
  Adds/ modifies systemd service files. Likely to achieve persistence.
  persistence privilege_escalation
- Write file to user bin folder
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

XDG Autostart Entries

Create or Modify System Process

Systemd Service

Privilege Escalation

Boot or Logon Autostart Execution

XDG Autostart Entries

Create or Modify System Process

Systemd Service

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

prometei_elfbotnetdiscoveryminerpersistenceprivilege_escalationupx