Prometei

What it is

Prometei is a botnet made of several parts that mines the cryptocurrency Monero and steals passwords, with versions for both Linux and Windows. It also gives the attackers a back door and updates itself. The Linux version researchers studied in 2021 installs itself as /usr/sbin/uplugplay and starts again after every restart through a startup entry called uplugplay.service and a scheduled task line. It keeps an ID file at /etc/CommId, and newer versions were analysed in 2025.

How it gets in

Through weak administrator passwords and internet-facing software that hasn't been updated.

Close the door: Use strong, unique administrator passwords (ideally key-based authentication), keep internet-facing software patched, and restrict management services to trusted networks with a firewall or VPN.

How to tell if you have it

Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.

These commands only look. They change nothing.

Look for the known file locations

sudo ls -la /etc/CommId /etc/systemd/system/multi-user.target.wants/uplugplay.service /lib/systemd/system/uplugplay.service /tmp/task.cron /usr/sbin/msdtc /usr/sbin/smcard /usr/sbin/updatecheckerd /usr/sbin/uplugplay 2>/dev/null

Search for the known file names (slow on big disks)

sudo find / -xdev \( -name 'uplugplay' -o -name 'upnpsetup' -o -name 'updatecheckerd' -o -name 'msdtc' -o -name 'smcard' -o -name 'crashed.dump' -o -name 'CommId' \) 2>/dev/null

Look for the known process names, and where each one runs from

for p in $(pgrep -f 'uplugplay|updatecheckerd|smcard'); do echo "$p $(sudo readlink /proc/$p/exe)"; done

List running programs that live in a temporary folder (real software almost never does)

sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'

Check every scheduled task for the known lines

sudo grep -rnF -e '@reboot /usr/sbin/uplugplay -cron' /etc/crontab /etc/cron.d /var/spool/cron 2>/dev/null

Check the known startup entries, wherever they are installed

systemctl list-unit-files --no-pager 2>/dev/null | grep -F -e 'uplugplay'; sudo ls -la /etc/init.d/uplugplay 2>/dev/null

Fingerprint a suspect file and compare it with the list below

sudo sha256sum /path/to/suspect-file

Known file fingerprints (SHA-256). A match identifies that exact file; newer builds differ.

How sure these signs are: The file locations, startup entry and scheduled task line come from a 2021 study of version 2. A 2025 study of versions 3 and 4 published fingerprints but no file locations, and says newer builds arrive under a different file name, so not finding uplugplay doesn't clear a server. msdtc is a normal Windows name; a file with that name in /usr/sbin on Linux is not expected, but confirm it by fingerprint. When it runs without root, it leaves crashed.dump and CommId in that user's home folder instead. The fingerprints identify the published samples only.

How to remove it by hand

Work through these in order. Don't skip the first two.

1. Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence first: the process list with where each process runs from, listening ports, the crontabs of root and the affected user, /lib/systemd/system/uplugplay.service, and copies of suspect files with their SHA-256 fingerprints.
2. Turn off the startup entry first so it can't restart anything while you clean. Run sudo systemctl cat uplugplay.service and confirm it runs /usr/sbin/uplugplay. Then run sudo systemctl disable --now uplugplay.service.
3. Find its processes by where they run from, not by name: for each suspect process number, run sudo readlink /proc/NUMBER/exe. A process running /usr/sbin/uplugplay, /usr/sbin/updatecheckerd, /usr/sbin/msdtc or /usr/sbin/smcard, or a file that matches a fingerprint above, is confirmed. Stop it with sudo kill NUMBER, and use kill -9 only if that doesn't work.
4. Delete /lib/systemd/system/uplugplay.service and the link /etc/systemd/system/multi-user.target.wants/uplugplay.service, then run sudo systemctl daemon-reload. In the scheduled tasks (crontabs) of root and the affected user, remove only the line @reboot /usr/sbin/uplugplay -cron with sudo crontab -e -u USERNAME, and leave every other line alone.
5. Move the confirmed programs in /usr/sbin (uplugplay, updatecheckerd, msdtc, smcard) into a folder only root can read, then delete the originals along with /etc/CommId and /tmp/task.cron. Check every home folder for crashed.dump and CommId too.
6. Run the checks above again. Then restart the server and check once more. Nothing should come back.
7. If the attacker had full control (root), or you can't confirm what changed, rebuild from a fresh install and restore only data you've checked.
8. It steals passwords, so from a clean computer, change the administrator and service passwords, SSH keys and tokens that were on the server, and cancel the old ones. Before you reconnect, switch to key logins, install all updates, and allow management services only from trusted networks.

What Minaki Scan does about it

Related threats

Sources

This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.

• Prometei botnet improves modules and exhibits new capabilities in recent updates, Cisco Talos (2023-03-09)
• IoT Malware Journals: Prometei (Linux), CUJO AI (2021-03-10)
• SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, NIST (2013-07)
• Resurgence of the Prometei Botnet, Palo Alto Networks Unit 42 (2025-06-20)