Prometei is a sophisticated, modular malware family that operates as a botnet, primarily targeting both Windows and Linux systems for illicit cryptocurrency mining (focusing on Monero), credential theft, and other malicious activities. First identified in 2020, with evidence of earlier variants dating back to 2016, Prometei has evolved significantly, with its latest versions demonstrating advanced persistence, lateral movement, and evasion capabilities.
Modular Architecture
• Prometei is built from multiple independent modules, each responsible for specific tasks such as brute-forcing credentials, exploiting vulnerabilities, mining cryptocurrency, stealing data, and maintaining command-and-control (C2) communications.
• This design allows the botnet to adapt quickly: individual modules can be updated or replaced without disrupting the overall operation.
Cross-Platform Targeting
• Early versions focused on Windows, but since late 2020, Linux variants have become prominent, especially in recent campaigns.
• The malware is distributed as 64-bit ELF binaries for Linux and PE files for Windows, often packed with tools like UPX to evade detection.
Propagation and Infection Methods
• Prometei spreads by exploiting well-known vulnerabilities, including:
• EternalBlue (SMB protocol exploit)
• BlueKeep (RDP vulnerability)
• Microsoft Exchange vulnerabilities (e.g., ProxyLogon, ProxyNotShell).
• It also uses brute-force attacks against RDP, SMB, and SSH services to gain initial access.
Command-and-Control (C2) Infrastructure
• Relies on a Domain Generation Algorithm (DGA) to dynamically generate domains for C2 communication, making it resilient against domain takedowns.
• Maintains persistence via scheduled tasks, services, and web shells (e.g., Apache with PHP web shell).
Self-Updating and Evasion
• Prometei can self-update its modules, allowing it to adapt to new security measures and evade detection.
• Uses obfuscation techniques, such as compressing payloads and encoding commands in Base64.
Symptoms of Infection
• Noticeable system slowdowns and overheating
• Unexpectedly high electricity bills (due to mining)
• Unrecognized processes or services running
• Persistent high network activity
• Rapid battery drain on laptops