Prometei Botnet Adds Self-Updating, C2 and Web Shell Capabilities
Summary
Cisco Talos details Prometei v3 updates observed since November 2022, including a new domain-generation algorithm, self-updating mechanism and bundled web shell. Sinkhole data indicated more than 10,000 infected systems worldwide.
Key points
- Talos estimates Prometei v3 infected more than 10,000 systems worldwide, based on a week of sinkhole data from February 2023.
- The botnet uses PowerShell to download and run components, establishes persistence through Windows services, and spreads through SMB, SSH, RDP and SQL servers.
- Prometei primarily deploys a Monero miner and also harvests credentials using a Mimikatz variant; Talos describes the activity as financially motivated and opportunistic.
- Newly observed capabilities include a domain-generation algorithm producing up to 48 potential C2 domains per day and a self-updating process that replaces bot components.
- Prometei deployed an Apache server with a PHP web shell on victim hosts, creating a command-execution and file-upload capability.
- The botnet’s Tor configuration now excludes Russia only; Talos says this may reflect a change in targeting but describes the conflict connection as an assessment.
- Talos considers the botnet ongoing and likely to evolve; it lists Cisco security products, Snort rules and ClamAV signatures as available defenses.
Article Details
- Attack Vectors
- Prometei spreads through SMB, SSH, RDP, and lateral movement attempts against SQL servers; the RDP module exploits BlueKeep (CVE-2019-0708).
- A malicious PowerShell command downloads and executes Prometei components from C2 servers, with additional components delivered in 7-Zip archives.
- Prometei deploys a bundled Apache Web Server with a PHP web shell on victim hosts; the shell can execute commands and copy uploaded files.
- The bot deploys a Monero miner and harvests credentials, including through a Mimikatz variant.
- Defensive Notes
- Cisco Talos lists Cisco Secure Endpoint, Cisco Secure Email, Cisco Secure Firewall, Cisco Secure Network/Cloud Analytics, Cisco Secure Malware Analytics, Umbrella, Cisco Secure Web Appliance, Cisco Duo, Snort, and ClamAV protections.
- Snort SIDs 54610–54612 and 61426–61429 are listed as defenses against this threat.
- Applicable ClamAV signatures listed are Win.Trojan.MSShellcode-6, Win.Coinminer.Generic-7151250-0, Win.Malware.Tgqv7oji-9939403-0, Win.Trojan.Mimikatz-6466236-0, and Win.Trojan.Prometei-8977166-0.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | xinchaoabcdcf[.]org | Example Prometei DGA domain observed in nslookup telemetry; generated for potential C2 use. |
| DOMAIN | xinchaocecclk[.]net | Example Prometei DGA domain observed in nslookup telemetry; generated for potential C2 use. |
| DOMAIN | xinchaocecclk[.]org | Example Prometei DGA domain observed in nslookup telemetry; generated for potential C2 use. |
| DOMAIN | xinchaodbcdbh[.]com | Example Prometei DGA domain observed in nslookup telemetry; generated for potential C2 use. |
| DOMAIN | xinchaodbcdbh[.]org | Example Prometei DGA domain observed in nslookup telemetry; generated for potential C2 use. |
| IPV4 | 103[.]65[.]236[.]53 | Mining pool address used in the Prometei miner command. |
| IPV4 | 177[.]73[.]237[.]55 | Mining pool address in a replacement miner command supplied by the C2. |
| IPV4 | 221[.]120[.]144[.]101 | Mining pool address in a replacement miner command supplied by the C2. |
MITRE ATT&CK
T0884The bot communicates with C2 through Tor, using a Tor connection module and a hardcoded .onion address.T1027 · Obfuscated Files or InformationPrometei downloads components in encrypted or obfuscated forms, including XOR-altered payloads and password-protected archives.T1036 · MasqueradingThe Apache HTTP daemon is renamed taskhost.exe to resemble a common Windows system executable.T1059.001 · PowerShellPrometei uses PowerShell commands to download, decode, write, and execute components.T1070.004 · File DeletionThe install.cmd updater deletes existing component files before replacing them with updated versions.T1105 · Ingress Tool TransferPrometei downloads its modules, archives, and mining payload from C2 servers to victim hosts.T1140 · Deobfuscate/Decode Files or InformationPrometei decodes downloaded or embedded data, including XOR-obfuscated payloads and base64-encoded commands.T1210 · Exploitation of Remote ServicesThe RDP spreading module exploits BlueKeep (CVE-2019-0708) on affected Windows systems.T1505.003 · Web ShellPrometei deploys a PHP web shell with a bundled Apache Web Server on victim hosts.T1562 · Impair DefensesA firewall rule adds sqhost.exe to the allowed programs list.T1569.002 · Service ExecutionThe bot creates Windows services, including UPlugPlay and KtmRmSvc, to run its components.T1584.005 · BotnetThe article identifies Prometei's botnet infrastructure as compromised infrastructure.
CVE
Malware
Products
Apache HTTP ServerFinally, Talos observed the Prometei bot dropping a compressed archive, named “AppServ180.zip”, which contains a version of the Apache Web Server bundled with a simple PHP-based web shell.Microsoft Windowsanalysis and current activity tracking that began in November 2022, we observed Prometei deploying Windows-based tools and malware and other Linux versions observed by security researchers.
Tools
Countries
Brazilthe most populous countries have the largest number of infected systems, with the exception of Brazil, Indonesia and Turkey displaying a higher proportion of infections compared to those countries’Indonesiathe most populous countries have the largest number of infected systems, with the exception of Brazil, Indonesia and Turkey displaying a higher proportion of infections compared to those countries’ populations.RussiaThe only excluded country in the Tor configuration is Russia, as supposed to earlier variants, which also avoided exit nodes in other CIS countries.Turkeycountries have the largest number of infected systems, with the exception of Brazil, Indonesia and Turkey displaying a higher proportion of infections compared to those countries’ populations.UkraineAdditionally, the bot’s targeting may have been influenced by the war in Ukraine.