Prometei Botnet (Linux/Prometei.B) — UPX-Packed Monero-Mining Bot with Cron/systemd Persistence, HTTP/DGA C2, and Tor/I2P Fallback — Threadlinqs Intelligence
As of 2026-02-20, Prometei Botnet (Linux/Prometei.B) — UPX-Packed Monero-Mining Bot with Cron/systemd Persistence, HTTP/DGA C2, and Tor/I2P Fallback is a medium-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-1490 · Severity: MEDIUM · Status: ACTIVE · Category: MALWARE
A February 2025 Linux/Prometei.B botnet sample (SHA-256 cc7ab872ed9c25d4346b4c58c5ef8ea48c2d7b256f20fe2f0912572208df5c1a) was reverse-engineered with Radare2's r2ai extension and Claude 3.5 Sonnet.
Prometei is a modular, cross-platform (Windows and Linux) botnet first identified in July 2020 (Windows) and December 2020 (Linux), financially motivated and built around Monero (XMR) cryptocurrency mining. This record documents a February 2, 2025 Linux/Prometei.B sample (SHA-256 cc7ab872ed9c25d4346b4c58c5ef8ea48c2d7b256f20fe2f0912572208df5c1a), publicly reverse-engineered by researcher cryptax using Radare2 with the r2ai AI-assisted analysis extension (backed by Claude 3.5 Sonnet via the Anthropic API). The sample is a 64-bit ELF packed with UPX 3.95; standard `upx -d` decompression failed because the malware author appends a custom JSON configuration trailer (fields observed: config, id, enckey, and in newer v3/v4 variants ParentId, ParentHostname, ParentIp, ip) directly after the UPX-compressed payload, which corrupts the UPX footer that unpacking tools rely on and requires the trailer to be manually stripped before standard decompression succeeds. This packing quirk limited the depth of the AI-assisted static analysis in the source writeup (Part One of an ongoing series), leaving several functions and control-flow paths only partially characterized.
Once executed, the dropper copies itself into a persistent location (observed under /usr/sbin as the binary/service name `uplugplay`), and establishes persistence through two redundant mechanisms: a cron job entry and a systemd service unit (also named uplugplay on Linux, mirrored by a Windows service historically named "UPlugPlay" pointing at C:\Windows\svchost.exe in the Windows branch of the family). The installer supports both unprivileged (standard-user) and privileged (root) install paths, broadening the range of initial-access foothold levels it can operationalize. After installation the binary performs systemd bookkeeping (checks service status, reloads systemd unit files, starts the service) and extensive host reconnaissance: reads /proc/cpuinfo for processor details, invokes `dmidecode --type baseboard` for motherboard/hardware fingerprinting, reads /etc/os-release or /etc/redhat-release for OS identification, checks system uptime, and runs `uname -a` for kernel versioning. It also enumerates running processes, probes for debugger presence (anti-analysis), modifies the local hosts file, and can self-delete to remove forensic traces.
C2 communication rides over plain HTTP GET requests to CGI-style endpoints. The February 2025 sample beacons to a domain pattern `p3.feefreepool[.]net` (evolved from the December 2020 family's `p1.feefreepool[.]net`) at a path resembling `/cgi-bin4rom`, carrying the bot's ID and an embedded/exchanged encryption key. Independent March-April 2025 telemetry from Unit 42 documents a parallel active wave hitting `hxxp://152.36.128[.]18/cgi-bin/p.cgi` for reconnaissance exfiltration and an initial-distribution stage at `hxxp://103.41.204[.]104/k.php?a=x86_64`, hosted on an Apache/PHP server running on a Windows host (ASN 58397, Infinys Network, Jakarta, Indonesia) — consistent with Prometei's historical pattern of C2 infrastructure churn while retaining the same operator TTPs. The 2020-era Windows/Linux campaign additionally used `bk1.bitspiritfun2[.]net` and IP 211.23.16[.]239 as primary C2, with roughly 18 additional C2 URLs spread across US, Germany, and Hong Kong hosting. For resilience against takedown, the malware implements a Domain Generation Algorithm (DGA) to compute fallback C2 domains, and additionally supports Tor and I2P as backup transport/anonymization layers — the February 2025 sample specifically references the I2P address `2oq.b32.i2p`, and the historical Windows branch used a dedicated proxy module (msdtc.exe) for Tor/I2P routing.
Beyond mining, Prometei is a lateral-movement worm: on Windows it drops a modified Mimikatz variant (historically named Miwalk.exe) to dump credentials from memory, an SMB spreader (rdpcIip.exe) that reuses stolen credentials or falls back to the EternalBlue (MS17-010) SMB exploit, and remote-exe
Weaknesses (CWE)
CWE-798, CWE-522, CWE-284
Target sectors: unspecified opportunistic internet-facing servers
Target regions: united states of america, brazil, turkey, pakistan, china, mexico, chile, germany, hong kong, indonesia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, MEDIUM, threat intelligence, cybersecurity, T1190, T1078, T1133, T1059, T1569.002, T1053.003, T1543.002, T1543.003, T1078, T1027.002