prometei_elf | 47aa54ded25dc9610f1511dc081a8feef48692c8a71cf585d3a26b0cb047c020

Analysis

max time kernel
7s
max time network
145s
platform
ubuntu-20.04_amd64
resource
ubuntu2004-amd64-20241127-en
resource tags

arch:amd64arch:i386image:ubuntu2004-amd64-20241127-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system
submitted
04/04/2025, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

na.elf
Size

425KB
MD5

a47712d5e98d5a57c942fee3378458e0
SHA1

81934957e7965e7322feaf57bec2a808daf6f941
SHA256

47aa54ded25dc9610f1511dc081a8feef48692c8a71cf585d3a26b0cb047c020
SHA512

1dfcaadcda183db8498db775645fa169f0d70a5cd51058cfb6bf3722d74f6fb44cf47cd3d232baf8f8d86ff795dbb6d85ecf78adba92b8f6505a3aacfe08b40f
SSDEEP

6144:63fxS1fHETSACF2Gzm5DVvSHrKKRH4SCra+HWMiFbcAOXmb4Dsi6wwcitgn:25WOSACZSV6eKRH5EPiamb4DsDwwc3

Score

10^/10

prometei_elf botnet discovery miner persistence privilege_escalation stealer upx

Malware Config

Signatures

Prometei
Prometei is a multiplatform botnet used to mine cryptocurrency.
botnet miner prometei_elf
Prometei_elf family
prometei_elf

Deletes itself 1 IoCs

pid	Process
1397	na.elf

Modifies hosts file 1 IoCs

Adds to hosts file used for mapping hosts to IP addresses.

description	ioc	Process
File opened for modification	/etc/hosts	na.elf

Reads EFI boot settings 1 TTPs 3 IoCs

Reads EFI boot settings from the efivars filesystem, may contain security secrets or sensitive data.

stealer

Bootkit

T1542.003

description	ioc	Process
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl
File opened for reading	/sys/firmware/efi/efivars/SystemdOptions-8cf2644b-4b0b-428f-9387-6d876050dc67	systemctl

Enumerates running processes
Discovers information about currently running processes on the system

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/lib/systemd/system/uplugplay.service	na.elf

Write file to user bin folder 1 IoCs

persistence

description	ioc	Process
File opened for modification	/usr/sbin/uplugplay	na.elf

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/fstream-1.dat	upx

Reads CPU attributes 1 TTPs 3 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep
File opened for reading	/sys/devices/system/cpu/online	pgrep

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1346/cmdline	pgrep
File opened for reading	/proc/175/cmdline	pidof
File opened for reading	/proc/3/cmdline	pgrep
File opened for reading	/proc/934/status	pgrep
File opened for reading	/proc/902/cmdline	pgrep
File opened for reading	/proc/1116/cmdline	pgrep
File opened for reading	/proc/173/stat	pidof
File opened for reading	/proc/1332/stat	pidof
File opened for reading	/proc/21/cmdline	pgrep
File opened for reading	/proc/897/cmdline	pgrep
File opened for reading	/proc/560/cmdline	pgrep
File opened for reading	/proc/14/status	pgrep
File opened for reading	/proc/970/cmdline	pgrep
File opened for reading	/proc/1330/status	pgrep
File opened for reading	/proc/629/status	pgrep
File opened for reading	/proc/1024/stat	pidof
File opened for reading	/proc/134/stat	pidof
File opened for reading	/proc/608/cmdline	pidof
File opened for reading	/proc/5/cmdline	pgrep
File opened for reading	/proc/71/status	pgrep
File opened for reading	/proc/400/stat	pidof
File opened for reading	/proc/1340/stat	pidof
File opened for reading	/proc/4/cmdline	pgrep
File opened for reading	/proc/634/cmdline	pidof
File opened for reading	/proc/1180/cmdline	pidof
File opened for reading	/proc/172/status	pgrep
File opened for reading	/proc/1029/cmdline	pgrep
File opened for reading	/proc/84/stat	pidof
File opened for reading	/proc/85/stat	pidof
File opened for reading	/proc/162/cmdline	pidof
File opened for reading	/proc/242/cmdline	pidof
File opened for reading	/proc/92/cmdline	pgrep
File opened for reading	/proc/1415/status	pgrep
File opened for reading	/proc/439/stat	pidof
File opened for reading	/proc/567/cmdline	pgrep
File opened for reading	/proc/452/cmdline	pgrep
File opened for reading	/proc/73/stat	pidof
File opened for reading	/proc/452/status	pgrep
File opened for reading	/proc/20/status	pgrep
File opened for reading	/proc/90/stat	pidof
File opened for reading	/proc/86/status	pgrep
File opened for reading	/proc/4/cmdline	pidof
File opened for reading	/proc/960/cmdline	pidof
File opened for reading	/proc/1312/cmdline	pgrep
File opened for reading	/proc/8/cmdline	pgrep
File opened for reading	/proc/626/status	pgrep
File opened for reading	/proc/1130/cmdline	pidof
File opened for reading	/proc/1402/cmdline	pgrep
File opened for reading	/proc/308/stat	pidof
File opened for reading	/proc/805/cmdline	pidof
File opened for reading	/proc/1098/cmdline	pidof
File opened for reading	/proc/9/status	pgrep
File opened for reading	/proc/1103/cmdline	pgrep
File opened for reading	/proc/173/stat	pidof
File opened for reading	/proc/11/cmdline	pgrep
File opened for reading	/proc/76/status	pgrep
File opened for reading	/proc/1116/cmdline	pgrep
File opened for reading	/proc/1328/cmdline	pgrep
File opened for reading	/proc/1338/status	pgrep
File opened for reading	/proc/994/cmdline	pgrep
File opened for reading	/proc/1201/status	pgrep
File opened for reading	/proc/11/cmdline	pidof
File opened for reading	/proc/74/cmdline	pidof
File opened for reading	/proc/15/status	pgrep

/tmp/na.elf
/tmp/na.elf
1⤵
- Deletes itself
- Modifies hosts file
- Modifies systemd
- Write file to user bin folder
PID:1397
- /bin/sh
  sh -c "pgrep na.elf"
  2⤵
  PID:1400
- - /usr/bin/pgrep
    pgrep na.elf
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1401
- /bin/sh
  sh -c "pgrep uplugplay"
  2⤵
  PID:1408
- - /usr/bin/pgrep
    pgrep uplugplay
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1409
- /bin/sh
  sh -c "pidof uplugplay"
  2⤵
  PID:1415
- - /usr/bin/pidof
    pidof uplugplay
    3⤵
    - Reads runtime system information
    PID:1417
- /bin/sh
  sh -c "pgrep upnpsetup"
  2⤵
  PID:1422
- - /usr/bin/pgrep
    pgrep upnpsetup
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1423
- /bin/sh
  sh -c "pidof upnpsetup"
  2⤵
  PID:1463
- - /usr/bin/pidof
    pidof upnpsetup
    3⤵
    - Reads runtime system information
    PID:1464
- /bin/sh
  sh -c "systemctl daemon-reload"
  2⤵
  PID:1465
- - /usr/bin/systemctl
    systemctl daemon-reload
    3⤵
    - Reads EFI boot settings
    PID:1466
- /bin/sh
  sh -c "systemctl enable uplugplay.service"
  2⤵
  PID:1504
- - /usr/bin/systemctl
    systemctl enable uplugplay.service
    3⤵
    - Reads EFI boot settings
    PID:1505
- /bin/sh
  sh -c "systemctl start uplugplay.service"
  2⤵
  PID:1534
- - /usr/bin/systemctl
    systemctl start uplugplay.service
    3⤵
    - Reads EFI boot settings
    PID:1535

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

XDG Autostart Entries

T1547.013

Create or Modify System Process

T1543

Systemd Service

T1543.002

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/usr/lib/systemd/system/uplugplay.service

Filesize
145B

MD5
8ca62d1f47880bce036c2956c9b7b272

SHA1
3bcc3a5c4fcc5b0d08c4524a59f6b8e113b62060

SHA256
c655d3d4e374fad38313ec4262207b2d7d68a870238f203ef3c33f85e66c8e32

SHA512
4cd2d9d67151fa25e833707dee2442c4a5f752053fc2c36ec73c0e2b734c66ca69c63fceb47714d9add5b9fe2eee1e45be5199e2cae7c26173e766b333877da6

Download Submit
/usr/sbin/uplugplay

Filesize
425KB

MD5
a47712d5e98d5a57c942fee3378458e0

SHA1
81934957e7965e7322feaf57bec2a808daf6f941

SHA256
47aa54ded25dc9610f1511dc081a8feef48692c8a71cf585d3a26b0cb047c020

SHA512
1dfcaadcda183db8498db775645fa169f0d70a5cd51058cfb6bf3722d74f6fb44cf47cd3d232baf8f8d86ff795dbb6d85ecf78adba92b8f6505a3aacfe08b40f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads