Threat reportMalwareTL-2026-4796
Prometei Botnet Linux Binary (Linux/Prometei.B) - Modular Monero Miner and Credential-Stealing Botnet, r2 + AI Reverse Engineering Analysis
Prometei is a modular, financially motivated botnet that infects Linux and Windows hosts to mine Monero and steal credentials. A Linux/Prometei.B sample dated 2025-02-02 was reverse engineered by cryptax with radare2 and AI assistance, and Unit 42 documented a resurgence of the Linux variants from March 2025. First disclosed .
Key facts for Prometei Linux botnet
| Identifiers | TL-2026-4796 |
|---|---|
| Also known as | Prometei, Linux/Prometei.B |
| Severity | HIGH |
| First disclosed | |
| Exploitation status | Exploited in the wild |
| Affected products | Linux (various) Linux servers (x86_64); Microsoft Windows (SMB, Prometei Windows variant) |
| Malware | Linux/Prometei.B, Prometei, xmrig |
| Tools | ETERNALBLUE, Tor - S0183, XMRig |
| MITRE ATT&CK techniques | T1005 Data from Local System, T1027.002 Software Packing, T1036.005 Match Legitimate Resource Name or Location, T1053.003 Cron, T1071.001 Web Protocols, T1082 System Information Discovery, T1090.003 Multi-hop Proxy, T1110 Brute Force, T1190 Exploit Public-Facing Application, T1496.001 Compute Hijacking, T1543.002 Systemd Service, T1568.002 Domain Generation Algorithms and 1 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | technology, government administration, finance, health |
| Target regions | Global |
| Detection rules | 9 (1 shown free) |
| Sources | 8 cited sources |
Detection coverage for Prometei Linux botnet
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4796 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Prometei Linux Dropper Download via k.php?a= (103.41.204.104) — Exploitation/Delivery
Detects HTTP GET requests to a k.php endpoint carrying an a= architecture parameter (optionally with a ,ParentId suffix), the delivery pattern used by the 2025 Prometei Linux wave to serve a 64-bit ELF (http://103.41.204.104/k.php?a=x86_64) despite the .php name. Behaviour-first: fires on the URI shape for any host and flags the known distribution IP 103.41.204.104. Maps to T1071.001 (web-protocol delivery) and T1027.002 (v3/v4 payloads are UPX-packed with a JSON config trailer).
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1071.001, T1027.002
- Data sources: splunk:index=web sourcetype=stream:http, CommonSecurityLog (proxy/firewall CEF), sigma:proxy
- Severity: high
- Confidence: high
Splunk SPL
index=web sourcetype=stream:http http_method=GET uri_path="*/k.php" uri_query="a=*"
| eval q=mvindex(split(uri_query,"a="),1), arch=mvindex(split(q,","),0), parent_id=mvindex(split(q,","),1)
| eval known_ioc=if(dest_ip=="103.41.204.104","yes","no")
| where match(arch,"^(x86_64|x86|i686|i386|aarch64|arm[a-z0-9]*|mips[a-z0-9]*)$") OR known_ioc=="yes"
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_ip) as dest_ip values(arch) as arch values(parent_id) as parent_id by src_ip, known_ioc
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ 'GET'
| where RequestURL contains '/k.php?a='
| extend Arch = extract(@'[?&]a=([^&,]+)', 1, RequestURL), ParentId = extract(@'[?&]a=[^&,]+,([^&]+)', 1, RequestURL)
| where Arch in~ ('x86_64','x86','i686','i386','aarch64') or DestinationIP == '103.41.204.104'
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 10) by SourceIP, DestinationIP, Arch, ParentId
| project FirstSeen, LastSeen, SourceIP, DestinationIP, Arch, ParentId, Hits, UrlsSigma
title: Prometei Dropper Download via k.php Architecture Parameter
id: 7c1f3a52-4b8e-4d26-9a07-5e2c81d4b6f3
status: experimental
description: Detects HTTP GET requests to a k.php endpoint with an a= architecture parameter, the delivery pattern used to serve the Prometei Linux ELF (for example http://103.41.204.104/k.php?a=x86_64, optionally with a ParentId suffix). Despite the .php name the response is a 64-bit ELF.
references:
- https://unit42.paloaltonetworks.com/prometei-botnet-2025-activity/
- https://rewterz.com/threat-advisory/prometei-botnet-hits-linux-for-crypto-mining-active-iocs
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-30
tags:
- attack.command_and_control
- attack.t1071.001
- attack.defense_evasion
- attack.t1027.002
logsource:
category: proxy
detection:
selection_param:
cs-method: 'GET'
c-uri|contains: '/k.php?a='
selection_ioc:
c-uri|contains: '103.41.204.104/k.php'
condition: selection_param or selection_ioc
falsepositives:
- Legitimate internal applications that expose a k.php script with an a= parameter
level: highKnown false positives:
- Internal web applications that legitimately expose a k.php script taking an a= parameter
- Security scanners or sandboxes replaying the published Prometei URL for research
Tuning notes: Add the sanctioned internal web servers to an exclusion list on dest_ip. Extend the architecture regex if new builds use other values. If proxy logs hold only hostnames, pivot on the URI shape alone and keep the 103.41.204.104 flag as a high-fidelity escalation field. Feed any hit to the egress-block list and hunt the source host for /usr/sbin/uplugplay.
- Prometei-Style SSH Brute Force Followed by Successful Login — Exploitation · unlock with TL Creds
- Prometei XMRig Miner updatecheckerd and Stratum Pool Activity — Post-Exploitation · unlock with TL Creds
- Prometei TOR/I2P C2 Resolution and DGA-Like Domain Bursts — C2 · unlock with TL Creds
- Prometei ELF Dropper Fetched via wget/curl from k.php or [indicator] — Exploitation · unlock with TL Creds
- Prometei Module Names and Known Sample Hashes Executed on Linux — Post-Exploitation · unlock with TL Creds
- Prometei Bot Host Reconnaissance (dmidecode, uname, cpuinfo) Spawned by Bot Binaries — C2 · unlock with TL Creds
- Prometei uplugplay Systemd and Cron Persistence on Linux — Post-Exploitation · unlock with TL Creds
- Prometei HTTP C2 Check-in to [indicator] and /cgi-bin/p.cgi — C2 · unlock with TL Creds
Indicators of compromise for Prometei Linux botnet
As of 2026-10-30, Threadlinqs Intelligence tracks 38 indicators of compromise for TL-2026-4796.
Sample indicators (3 of 38)
- IP address:
103.41.204[.]104 - Domain:
p1[.]feefreepool[.]net - File hash:
46cf75d7440c30cbfd101dd396bb18dc3ea0b9fe475eb80c4545868aab5c578c
Defanged, TLP:CLEAR. Full set of 38 indicators: unlock with TL Creds.
How Prometei Linux botnet works
Prometei refers to both a malware family and the botnet it operates. Windows samples were first identified in July 2020 and a Linux version followed in December 2020. The botnet is modular: components brute-force administrator credentials, exploit remote-service vulnerabilities (on Windows, SMB flaws including EternalBlue), mine Monero, steal data and communicate with command-and-control (C2) servers.
The subject of this entry is a write-up by cryptax, 'Reversing a Prometei botnet binary with r2 and AI - Part One', which analyses a Linux/Prometei.B sample dated 2025-02-02 using radare2 and AI assistance. The article body could not be retrieved (HTTP 403), so none of its specific findings are reproduced here. The technical content below comes from corroborating public reporting on the same malware family: Unit 42 (2025 activity), CUJO AI (Linux analysis), and Rewterz (IOC advisory).
Delivery and packing: the 2025 wave is delivered by HTTP GET to hxxp://103.41.204.104/k.php?a=x86_64 (optionally with a ParentId suffix). Despite the .php name, the response is a 64-bit ELF executable. Version 2 samples are not packed; v3 and v4 samples are UPX-packed (modified UPX per Rewterz) and carry an appended custom JSON configuration trailer. The v2 trailer holds config, id and enckey. Versions 3 and 4 add ParentId, ParentHostname, ParentIp and ip, which supports parent-to-child propagation tracking. Unit 42 lists hashes for v2.87X, v3.05L, v4.02V (seven variants) and v4.08V.
Persistence and masquerading (CUJO AI analysis of the Linux bot): the main binary is named uplugplay. Root installs ('Systemmode') copy it to /usr/sbin/uplugplay, create /lib/systemd/system/uplugplay.service with a symlink under /etc/systemd/system/multi-user.target.wants/, and add a crontab entry '@reboot /usr/sbin/uplugplay -cron'. Non-root installs ('Usermode') place files under the user's home directory. Additional components include msdtc/msdtc2 (proxy client), smcard/smcard2 (TOR relay), upnpsetup, and the XMRig miner run as updatecheckerd.
C2: the bot checks in via HTTP/1.0 to /cgi-bin/prometei.cgi on clear-web, .onion and I2P endpoints. Check-in parameters are r (random integer 0-30), i (unique 16-byte victim identifier), h (hostname) and enckey (Base64 key). The 2025 samples report system information by HTTP GET to hxxp://152.36.128.18/cgi-bin/p.cgi. The collected data is /proc/cpuinfo, dmidecode output, /etc/os-release or /etc/redhat-release, uptime and uname -a. A domain generation algorithm (DGA) and a self-update capability (the updatev4 command) provide resilience. The bot supports 14 commands: chkport, debug, exec, extip, quit, quit2, set_cc, start_mining, stop_mining, sysinfo, touch, updatev4, wget and xwget. XMRig is configured with a 1% donation level and, in the 2020-era sample, the pool stratum+tcp://5.189.171.187:3333.
Attribution: reporting describes a financially motivated criminal operation with no evidence of nation-state ties. No named actor was identified in the sources reviewed.
Caveats: the cryptax article's own findings are unverified. The CUJO persistence, command and pool details were observed in 2020 Linux samples and may differ in v4 builds. BeaconBeagle returned HTTP 404 for the two 2025 IPs, so no C2 correlation was available.
MITRE ATT&CK techniques by tactic:
Collection
Defense Evasion
T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location
Persistence
T1053.003 Cron; T1543.002 Systemd Service
Command and Control
T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1568.002 Domain Generation Algorithms
Discovery
T1082 System Information Discovery
Credential Access
Initial Access
T1190 Exploit Public-Facing Application
Impact
Lateral Movement
Remediation for Prometei Linux botnet
Patches
- Apply Microsoft MS17-010 on Windows hosts to close the EternalBlue SMB exploitation vector
Immediate actions
- Block 103.41.204.104 and 152.36.128.18 at the perimeter and alert on HTTP requests to /k.php?a=x86_64 and /cgi-bin/p.cgi
- Hunt Linux hosts for /usr/sbin/uplugplay, /lib/systemd/system/uplugplay.service, an '@reboot /usr/sbin/uplugplay -cron' crontab entry, and an updatecheckerd (XMRig) process
- Hunt for the published SHA-256 hashes and for UPX-packed ELF files downloaded with a .php name
- Rotate credentials on any host where Prometei was found, since the bot brute-forces and steals credentials
Workarounds
- Disable SMBv1 and block SMB from untrusted networks
- Restrict direct internet exposure of SSH and administrative services
Longer-term hardening
- Enforce strong unique passwords and MFA on SSH, RDP and SMB-exposed services, and monitor for brute-force activity
- Deploy EDR with behavioral detection for crypto-mining and unexpected systemd or cron persistence
- Restrict egress and alert on outbound TOR and I2P traffic from servers
- Monitor for abnormal sustained CPU usage on servers as a cryptomining indicator
Affected and fixed versions
- Linux (various) — Linux servers (x86_64)
Vulnerable versions: Hosts with weak or brute-forceable credentials; Prometei v2.87X, v3.05L, v4.02V, v4.08V ELF builds observed - Microsoft — Windows (SMB, Prometei Windows variant)
Vulnerable versions: Systems unpatched against EternalBlue (MS17-010)
Fixed in: MS17-010 security update
Timeline of Prometei Linux botnet
- Prometei botnet first identified (Windows variant). Source gives month precision only (July 2020).
- Linux version of Prometei discovered, with the uplugplay main binary, locked-ioc-38 miner and TOR/I2P-capable modules. Source gives early December 2020.
- CUJO AI publishes 'IoT Malware Journals - Prometei (Linux)', documenting the Linux port (uplugplay, locked-ioc-37, locked-ioc-36, updatecheckerd/locked-ioc-38, 14 commands) and noting it was ported from Windows rather than derived from Mirai or Gafgyt.
- locked-ioc-29 sample dated 2025-02-02 analysed by cryptax with radare2 and AI assistance (per search summary of the Medium article).
- Unit 42 reports a resurgence wave of Prometei Linux variants beginning March 2025, delivered via k.php and reporting to p.cgi. Source gives month precision only.
- Unit 42 sample collection period (March to late April 2025) covers v2.87X, v3.05L, v4.02V and v4.08V builds. Day is approximate (late April per source).
- Unit 42 publishes 'Prometei botnet 2025 activity' and Rewterz publishes an IOC advisory on the same date, listing v2.87X, v3.05L, v4.02V and v4.08V hashes plus locked-ioc-30 and locked-ioc-32.
Sources cited for Prometei Linux botnet
- Rewterz: Prometei Botnet Hits Linux for Crypto Mining - Active IOCs rewterz.com · Advisory · 2025-06-20
- Reversing a Prometei botnet binary with r2 and AI - Part One (cryptax; body not retrievable, HTTP 403) cryptax.medium.com · Research
- Unit 42: Prometei botnet 2025 activity Unit 42 · Research · 2025-06-20
- CUJO AI: IoT Malware Journals - Prometei (Linux) cujo.com · Research · 2021-03-10
- Gurucul: Resurgence of the Prometei Botnet gurucul.com · Blog
- OffSeq Radar: Resurgence of the Prometei Botnet radar.offseq.com · Blog
- Cyber Security News: Prometei Botnet Attacking Linux Servers to Mine Cryptocurrency cybersecuritynews.com · News
- SC Media: Linux servers subjected to resurgent Prometei botnet intrusions scworld.com · News
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.
