General
- Target na.elf
- Size 1.2MB
- Sample261113-php32abv7y
- SHA256 65ed7ba78dbb34a2a2ed47650b0b79ae3ebd3bd6910e3882414b99fafa155c4b
Score
10/10
Malware Config
Targets
-
- Target na.elf
- Size 1.2MB
- SHA256 65ed7ba78dbb34a2a2ed47650b0b79ae3ebd3bd6910e3882414b99fafa155c4b
Score10/10Family: Prometei
Prometei is a multiplatform botnet used to mine cryptocurrency.
Prometei payload
Deletes itself
Modifies the /etc/hosts DNS resolution file
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
Enumerates running processes
Discovers information about currently running processes on the system
Modifies systemd
Adds/ modifies systemd service files. Likely to achieve persistence.
Write file to user bin folder
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1XDG Autostart Entries
1Create or Modify System Process
1Systemd Service
1