In March 2025, the Prometei botnet resurfaced with new Linux variants featuring enhanced stealth through UPX packing and a custom configuration JSON trailer. This malware focuses on cryptocurrency mining and credential theft while employing a domain generation algorithm and self-updating capabilities to maintain persistence. #Prometei #Monero #Unit42
Keypoints
- Prometei is a modular botnet malware family active since 2020, targeting Linux and Windows systems, primarily for Monero mining and credential theft.
- The March 2025 resurgence introduced Linux variants packed with UPX and appended with a configuration JSON trailer to evade detection.
- The malware uses a domain generation algorithm (DGA) and self-updating features to ensure resilience and stealth against defensive measures.
- Propagation techniques include brute-forcing credentials, exploiting EternalBlue and SMB vulnerabilities for lateral movement within networks.
- Static analysis revealed that the malware collects detailed system information and communicates with C2 servers via specific HTTP GET requests.
- Palo Alto Networks provides extensive defense through Advanced WildFire, Threat Prevention, URL Filtering, DNS Security, Cortex XDR, and Cortex XSIAM.
- Indicators of compromise include specific SHA-256 hashes of malware samples and URLs used for distribution and command-and-control communication.
MITRE Techniques
- [T1110] Brute Force – Prometei conducts brute-force attacks against administrator credentials to gain initial access (‘Brute-forcing administrator credentials’).
- [T1210] Exploitation of Remote Services – Uses exploits such as EternalBlue and SMB protocol vulnerabilities for lateral movement (‘leveraging EternalBlue and exploiting SMB protocol flaws to spread laterally’).
- [T1496] Resource Hijacking – Mines cryptocurrency (Monero) on compromised systems (‘allows attackers to remotely control compromised systems for cryptocurrency mining’).
- [T1083] File and Directory Discovery – Collects system information from /proc/cpuinfo, dmidecode, /etc/os-release and uptime commands (‘The sample also contains another subroutine responsible for collecting compromised system information’).
- [T1071] Application Layer Protocol – Uses HTTP GET requests for C2 communication and data exfiltration (‘The collected system information is submitted via HTTP GET to the C2 server’).
- [T1027] Obfuscated Files or Information – Packs malware with UPX and adds a JSON configuration trailer to evade analysis (‘Prometei malware is distributed using UPX packing and a custom configuration JSON trailer’).
- [T1588] Obtain Capabilities – Self-updating malware modules allow adaptation and deployment of new payloads (‘integrate self-updating features for stealth and evasion’).
Indicators of Compromise
- [File Hashes] Prometei malware samples – 46cf75d7440c30cbfd101dd396bb18dc3ea0b9fe475eb80c4545868aab5c578c (v2.87X), cc7ab872ed9c25d4346b4c58c5ef8ea48c2d7b256f20fe2f0912572208df5c1a (v3.05L), and multiple hashes for v4.02V variants.
- [URLs] Malware distribution – hxxp://103.41.204[.]104/k.php used to deliver Prometei binaries.
- [URLs] Command-and-Control – hxxp://152.36.128[.]18/cgi-bin/p.cgi used for system information exfiltration and C2 communication.
Read more: https://unit42.paloaltonetworks.com/prometei-botnet-2025-activity/