Malwarehigh
Prometei botnet improves modules and exhibits new capabilities in recent updates
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-0708 | Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep) | 9.8 | 100% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | gb7ni5rgeexdcncj.onion | y the hardcoded URL in sqhost.exe and “onion” TLD: “hxxps://gb7ni5rgeexdcncj[.]onion/cgi-bin/prometei.cgi”. The actual cryptocurrency mining p |
| domain | xinchaoabcdcf.org | s within telemetry: xinchaodbcdbh[.]org xinchaodbcdbh[.]com xinchaoabcdcf[.]org xinchaocecclk[.]org xinchaocecclk[.]net We have included |
| domain | xinchaocecclk.com | visible on the command line as follows: nslookup -type=all xinchaocecclk[.]com 8[.]8.8.8 A side effect of this is that nslookup calls ac |
| domain | xinchaocecclk.net | xinchaodbcdbh[.]com xinchaoabcdcf[.]org xinchaocecclk[.]org xinchaocecclk[.]net We have included a simple Python script to help with disc |
| domain | xinchaocecclk.org | xinchaodbcdbh[.]org xinchaodbcdbh[.]com xinchaoabcdcf[.]org xinchaocecclk[.]org xinchaocecclk[.]net We have included a simple Python scri |
| domain | xinchaodbcdbh.com | sed in nslookup calls within telemetry: xinchaodbcdbh[.]org xinchaodbcdbh[.]com xinchaoabcdcf[.]org xinchaocecclk[.]org xinchaocecclk[.]n |
| domain | xinchaodbcdbh.org | e of the following used in nslookup calls within telemetry: xinchaodbcdbh[.]org xinchaodbcdbh[.]com xinchaoabcdcf[.]org xinchaocecclk[.]o |
| ipv4 | 103.65.236.53 | with the Prometei actor: searchindexer.exe -o stratum+tcp://103.65.236[.]53:80 -u 4A1txQ9L8h8NqF4EtGsZDP5vRN3yTVKynbkyP1jvCiDajNLPepP |
| ipv4 | 177.73.237.55 | lBytes('C:\Windows\dell\Desktop.dat',$d); “-o stratum+tcp://177.73.237[.]55:80 --donate-level 1 -p x -u id” The purpose and usage of |
| ipv4 | 221.120.144.101 | lBytes('C:\Windows\dell\Desktop.dat',$d); “-o stratum+tcp://221.120.144[.]101:3333 --donate-level 1 -p x -u id” and powershell.exe $d=[ |
| ipv4 | 8.8.8.8 | -generated domain name, as well as with a server parameter “8[.]8.8.8” in order to specifically use Google’s public DNS. This c |
| url | https://gb7ni5rgeexdcncj.onion/cgi-bin/prometei.cgi” | sented by the hardcoded URL in sqhost.exe and “onion” TLD: “hxxps://gb7ni5rgeexdcncj[.]onion/cgi-bin/prometei.cgi”. The actual cryptocurrency mining payload is also retriev |
From the original article
12 min read at blog.talosintelligence.com
Prometei botnet continued its activity since Cisco Talos first reported about it in 2020. Since November 2022, we have observed Prometei improving the infrastructure components and capabilities. More specifically, the botnet operators updated certain submodules of the execution chain to automate processes and challenge forensic analysis methods.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.