# Prometei Botnet Linux Binary (Linux/Prometei.B) - Modular Monero Miner and Credential-Stealing Botnet, r2 + AI Reverse Engineering Analysis

> Prometei is a modular, financially motivated botnet that infects Linux and Windows hosts to mine Monero and steal credentials. A Linux/Prometei.B sample dated 2025-02-02 was reverse engineered by cryptax with radare2 and AI assistance, and Unit 42 documented a resurgence of the Linux variants from March 2025.

- **Published:** 2026-10-30T03:55:09Z
- **Last reviewed:** 2026-10-30T03:55:09Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4796
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4796.png
- **ID:** TL-2026-4796
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 38 (3 shown free below)

## Description

Prometei refers to both a malware family and the botnet it operates. Windows samples were first identified in July 2020 and a Linux version followed in December 2020. The botnet is modular: components brute-force administrator credentials, exploit remote-service vulnerabilities (on Windows, SMB flaws including EternalBlue), mine Monero, steal data and communicate with command-and-control (C2) servers.

The subject of this entry is a write-up by cryptax, 'Reversing a Prometei botnet binary with r2 and AI - Part One', which analyses a Linux/Prometei.B sample dated 2025-02-02 using radare2 and AI assistance. The article body could not be retrieved (HTTP 403), so none of its specific findings are reproduced here. The technical content below comes from corroborating public reporting on the same malware family: Unit 42 (2025 activity), CUJO AI (Linux analysis), and Rewterz (IOC advisory).

Delivery and packing: the 2025 wave is delivered by HTTP GET to hxxp://103.41.204.104/k.php?a=x86_64 (optionally with a ParentId suffix). Despite the .php name, the response is a 64-bit ELF executable. Version 2 samples are not packed; v3 and v4 samples are UPX-packed (modified UPX per Rewterz) and carry an appended custom JSON configuration trailer. The v2 trailer holds config, id and enckey. Versions 3 and 4 add ParentId, ParentHostname, ParentIp and ip, which supports parent-to-child propagation tracking. Unit 42 lists hashes for v2.87X, v3.05L, v4.02V (seven variants) and v4.08V.

Persistence and masquerading (CUJO AI analysis of the Linux bot): the main binary is named uplugplay. Root installs ('Systemmode') copy it to /usr/sbin/uplugplay, create /lib/systemd/system/uplugplay.service with a symlink under /etc/systemd/system/multi-user.target.wants/, and add a crontab entry '@reboot /usr/sbin/uplugplay -cron'. Non-root installs ('Usermode') place files under the user's home directory. Additional components include msdtc/msdtc2 (proxy client), smcard/smcard2 (TOR relay), upnpsetup, and the XMRig miner run as updatecheckerd.

C2: the bot checks in via HTTP/1.0 to /cgi-bin/prometei.cgi on clear-web, .onion and I2P endpoints. Check-in parameters are r (random integer 0-30), i (unique 16-byte victim identifier), h (hostname) and enckey (Base64 key). The 2025 samples report system information by HTTP GET to hxxp://152.36.128.18/cgi-bin/p.cgi. The collected data is /proc/cpuinfo, dmidecode output, /etc/os-release or /etc/redhat-release, uptime and uname -a. A domain generation algorithm (DGA) and a self-update capability (the updatev4 command) provide resilience. The bot supports 14 commands: chkport, debug, exec, extip, quit, quit2, set_cc, start_mining, stop_mining, sysinfo, touch, updatev4, wget and xwget. XMRig is configured with a 1% donation level and, in the 2020-era sample, the pool stratum+tcp://5.189.171.187:3333.

Attribution: reporting describes a financially motivated criminal operation with no evidence of nation-state ties. No named actor was identified in the sources reviewed.

Caveats: the cryptax article's own findings are unverified. The CUJO persistence, command and pool details were observed in 2020 Linux samples and may differ in v4 builds. BeaconBeagle returned HTTP 404 for the two 2025 IPs, so no C2 correlation was available.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1543.002 Systemd Service
- T1053.003 Cron
- T1036.005 Match Legitimate Resource Name or Location
- T1027.002 Software Packing
- T1110 Brute Force
- T1082 System Information Discovery
- T1570 Lateral Tool Transfer
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1568.002 Domain Generation Algorithms
- T1090.003 Multi-hop Proxy
- T1496.001 Compute Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Prometei Linux Dropper Download via k.php?a= (103.41.204.104) — Exploitation/Delivery** (`TL-2026-4796-SPL-001`)

Detects HTTP GET requests to a k.php endpoint carrying an a= architecture parameter (optionally with a ,ParentId suffix), the delivery pattern used by the 2025 Prometei Linux wave to serve a 64-bit ELF (http://103.41.204.104/k.php?a=x86_64) despite the .php name. Behaviour-first: fires on the URI shape for any host and flags the known distribution IP 103.41.204.104. Maps to T1071.001 (web-protocol delivery) and T1027.002 (v3/v4 payloads are UPX-packed with a JSON config trailer).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1027.002
- **Data sources:** splunk:index=web sourcetype=stream:http, CommonSecurityLog (proxy/firewall CEF), sigma:proxy
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype=stream:http http_method=GET uri_path="*/k.php" uri_query="a=*"
| eval q=mvindex(split(uri_query,"a="),1), arch=mvindex(split(q,","),0), parent_id=mvindex(split(q,","),1)
| eval known_ioc=if(dest_ip=="103.41.204.104","yes","no")
| where match(arch,"^(x86_64|x86|i686|i386|aarch64|arm[a-z0-9]*|mips[a-z0-9]*)$") OR known_ioc=="yes"
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_ip) as dest_ip values(arch) as arch values(parent_id) as parent_id by src_ip, known_ioc
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestMethod =~ 'GET'
| where RequestURL contains '/k.php?a='
| extend Arch = extract(@'[?&]a=([^&,]+)', 1, RequestURL), ParentId = extract(@'[?&]a=[^&,]+,([^&]+)', 1, RequestURL)
| where Arch in~ ('x86_64','x86','i686','i386','aarch64') or DestinationIP == '103.41.204.104'
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Urls = make_set(RequestURL, 10) by SourceIP, DestinationIP, Arch, ParentId
| project FirstSeen, LastSeen, SourceIP, DestinationIP, Arch, ParentId, Hits, Urls
```

### Sigma

```yaml
title: Prometei Dropper Download via k.php Architecture Parameter
id: 7c1f3a52-4b8e-4d26-9a07-5e2c81d4b6f3
status: experimental
description: Detects HTTP GET requests to a k.php endpoint with an a= architecture parameter, the delivery pattern used to serve the Prometei Linux ELF (for example http://103.41.204.104/k.php?a=x86_64, optionally with a ParentId suffix). Despite the .php name the response is a 64-bit ELF.
references:
  - https://unit42.paloaltonetworks.com/prometei-botnet-2025-activity/
  - https://rewterz.com/threat-advisory/prometei-botnet-hits-linux-for-crypto-mining-active-iocs
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-30
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.defense_evasion
  - attack.t1027.002
logsource:
  category: proxy
detection:
  selection_param:
    cs-method: 'GET'
    c-uri|contains: '/k.php?a='
  selection_ioc:
    c-uri|contains: '103.41.204.104/k.php'
  condition: selection_param or selection_ioc
falsepositives:
  - Legitimate internal applications that expose a k.php script with an a= parameter
level: high
```

**Known false positives:**

- Internal web applications that legitimately expose a k.php script taking an a= parameter
- Security scanners or sandboxes replaying the published Prometei URL for research

**Tuning notes:** Add the sanctioned internal web servers to an exclusion list on dest_ip. Extend the architecture regex if new builds use other values. If proxy logs hold only hostnames, pivot on the URI shape alone and keep the 103.41.204.104 flag as a high-fidelity escalation field. Feed any hit to the egress-block list and hunt the source host for /usr/sbin/uplugplay.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Prometei-Style SSH Brute Force Followed by Successful Login — Exploitation (locked: unlock with TL Creds)
- Prometei XMRig Miner updatecheckerd and Stratum Pool Activity — Post-Exploitation (locked: unlock with TL Creds)
- Prometei TOR/I2P C2 Resolution and DGA-Like Domain Bursts — C2 (locked: unlock with TL Creds)
- Prometei ELF Dropper Fetched via wget/curl from k.php or [indicator] — Exploitation (locked: unlock with TL Creds)
- Prometei Module Names and Known Sample Hashes Executed on Linux — Post-Exploitation (locked: unlock with TL Creds)
- Prometei Bot Host Reconnaissance (dmidecode, uname, cpuinfo) Spawned by Bot Binaries — C2 (locked: unlock with TL Creds)
- Prometei uplugplay Systemd and Cron Persistence on Linux — Post-Exploitation (locked: unlock with TL Creds)
- Prometei HTTP C2 Check-in to [indicator] and /cgi-bin/p.cgi — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 38)

Defanged, TLP:CLEAR.

- IP address: `103.41.204[.]104`
- Domain: `p1[.]feefreepool[.]net`
- File hash: `46cf75d7440c30cbfd101dd396bb18dc3ea0b9fe475eb80c4545868aab5c578c`

Full set of 38 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Reversing a Prometei botnet binary with r2 and AI - Part One (cryptax; body not retrievable, HTTP 403)](https://cryptax.medium.com/reversing-a-prometei-botnet-binary-with-r2-and-ai-part-one-3cdb3dc6ffab)
- [Unit 42: Prometei botnet 2025 activity](https://unit42.paloaltonetworks.com/prometei-botnet-2025-activity/)
- [CUJO AI: IoT Malware Journals - Prometei (Linux)](https://cujo.com/iot-malware-journals-prometei-linux/)
- [Rewterz: Prometei Botnet Hits Linux for Crypto Mining - Active IOCs](https://rewterz.com/threat-advisory/prometei-botnet-hits-linux-for-crypto-mining-active-iocs)
- [Gurucul: Resurgence of the Prometei Botnet](https://gurucul.com/latest-threats/resurgence-of-the-prometei-botnet/)
- [Cyber Security News: Prometei Botnet Attacking Linux Servers to Mine Cryptocurrency](https://cybersecuritynews.com/prometei-botnet-attacking-linux-servers/)
- [SC Media: Linux servers subjected to resurgent Prometei botnet intrusions](https://www.scworld.com/brief/linux-servers-subjected-to-resurgent-prometei-botnet-intrusions)
- [OffSeq Radar: Resurgence of the Prometei Botnet](https://radar.offseq.com/threat/resurgence-of-the-prometei-botnet-31935097)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4796