Minaki Scan

Threat wiki / Prometei

Prometei

Tested on a planted test copy, not a real sample

Minaki Scan's removal was tested on an isolated test machine where a harmless stand-in played the malware. That proves the removal works on the signs listed here; it was not run against the real malware.

What it isModular Monero-mining botnet with a Linux variant (backdoor, credential theft, self-updating)
Goes afterLinux servers (and Windows hosts) used for Monero mining and credential theft
Our verdictCan be removed with care
Last reviewed2026-10-15

What it is

Prometei is a botnet made of several parts that mines the cryptocurrency Monero and steals passwords, with versions for both Linux and Windows. It also gives the attackers a back door and updates itself. The Linux version researchers studied in 2021 installs itself as /usr/sbin/uplugplay and starts again after every restart through a startup entry called uplugplay.service and a scheduled task line. It keeps an ID file at /etc/CommId, and newer versions were analysed in 2025.

How it gets in

Through weak administrator passwords and internet-facing software that hasn't been updated.

Close the door: Use strong, unique administrator passwords (ideally key-based authentication), keep internet-facing software patched, and restrict management services to trusted networks with a firewall or VPN.

How to tell if you have it

Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.

KindSign
File location/usr/sbin/uplugplay
File location/lib/systemd/system/uplugplay.service
File location/etc/systemd/system/multi-user.target.wants/uplugplay.service
File location/etc/CommId
File location/tmp/task.cron
File location/usr/sbin/updatecheckerd
File location/usr/sbin/msdtc
File location/usr/sbin/smcard
File location/home/<user>/crashed.dump
File nameuplugplay
File nameupnpsetup
File nameupdatecheckerd
File namemsdtc
File namesmcard
File namecrashed.dump
File nameCommId
Process nameuplugplay
Process nameupdatecheckerd
Process namesmcard
Scheduled task line@reboot /usr/sbin/uplugplay -cron
Startup entryuplugplay.service

These commands only look. They change nothing.

Look for the known file locations:

sudo ls -la /etc/CommId /etc/systemd/system/multi-user.target.wants/uplugplay.service /lib/systemd/system/uplugplay.service /tmp/task.cron /usr/sbin/msdtc /usr/sbin/smcard /usr/sbin/updatecheckerd /usr/sbin/uplugplay 2>/dev/null

Search for the known file names (slow on big disks):

sudo find / -xdev \( -name 'uplugplay' -o -name 'upnpsetup' -o -name 'updatecheckerd' -o -name 'msdtc' -o -name 'smcard' -o -name 'crashed.dump' -o -name 'CommId' \) 2>/dev/null

Look for the known process names, and where each one runs from:

for p in $(pgrep -f 'uplugplay|updatecheckerd|smcard'); do echo "$p $(sudo readlink /proc/$p/exe)"; done

List running programs that live in a temporary folder (real software almost never does):

sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'

Check every scheduled task for the known lines:

sudo grep -rnF -e '@reboot /usr/sbin/uplugplay -cron' /etc/crontab /etc/cron.d /var/spool/cron 2>/dev/null

Check the known startup entries, wherever they are installed:

systemctl list-unit-files --no-pager 2>/dev/null | grep -F -e 'uplugplay'; sudo ls -la /etc/init.d/uplugplay 2>/dev/null

Fingerprint a suspect file and compare it with the list below:

sudo sha256sum /path/to/suspect-file

Known file fingerprints (SHA-256). A match identifies that exact file; newer builds differ.

07cb3e27c8cd53b267ad2f1367735b99d04d3d5b5ecc25d0dedc7856d792eaa2 0eefa989b04824ab190c9582b0068ffbb5bd0abd61dd4933d3abe5cf4a91c6c1 9b4ae19d6de1023fb9d828badaff720d1f4f44268f6d94aa27cf00347dd93e6e fb84793c36a8a6b71a6426a0899e567f44206c01f62ab8074204aa37e9307244 46cf75d7440c30cbfd101dd396bb18dc3ea0b9fe475eb80c4545868aab5c578c cc7ab872ed9c25d4346b4c58c5ef8ea48c2d7b256f20fe2f0912572208df5c1a 205c2a562bb393a13265c8300f5f7e46d3a1aabe057cb0b53d8df92958500867 656fa59c4acf841dcc3db2e91c1088daa72f99b468d035ff79d31a8f47d320ef 67279be56080b958b04a0f220c6244ea4725f34aa58cf46e5161cfa0af0a3fb0 7a027fae1d7460fc5fccaf8bed95e9b28167023efcbb410f638c5416c6af53ff 87f5e41cbc5a7b3f2862fed3f9458cd083979dfce45877643ef68f4c2c48777e d4566c778c2c35e6162a8e65bb297c3522dd481946b81baffc15bb7d7a4fe531

How sure these signs are: The file locations, startup entry and scheduled task line come from a 2021 study of version 2. A 2025 study of versions 3 and 4 published fingerprints but no file locations, and says newer builds arrive under a different file name, so not finding uplugplay doesn't clear a server. msdtc is a normal Windows name; a file with that name in /usr/sbin on Linux is not expected, but confirm it by fingerprint. When it runs without root, it leaves crashed.dump and CommId in that user's home folder instead. The fingerprints identify the published samples only.

How to remove it by hand

Work through these in order. Don't skip the first two.

  1. Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence first: the process list with where each process runs from, listening ports, the crontabs of root and the affected user, /lib/systemd/system/uplugplay.service, and copies of suspect files with their SHA-256 fingerprints.
  2. Turn off the startup entry first so it can't restart anything while you clean. Run sudo systemctl cat uplugplay.service and confirm it runs /usr/sbin/uplugplay. Then run sudo systemctl disable --now uplugplay.service.
  3. Find its processes by where they run from, not by name: for each suspect process number, run sudo readlink /proc/NUMBER/exe. A process running /usr/sbin/uplugplay, /usr/sbin/updatecheckerd, /usr/sbin/msdtc or /usr/sbin/smcard, or a file that matches a fingerprint above, is confirmed. Stop it with sudo kill NUMBER, and use kill -9 only if that doesn't work.
  4. Delete /lib/systemd/system/uplugplay.service and the link /etc/systemd/system/multi-user.target.wants/uplugplay.service, then run sudo systemctl daemon-reload. In the scheduled tasks (crontabs) of root and the affected user, remove only the line @reboot /usr/sbin/uplugplay -cron with sudo crontab -e -u USERNAME, and leave every other line alone.
  5. Move the confirmed programs in /usr/sbin (uplugplay, updatecheckerd, msdtc, smcard) into a folder only root can read, then delete the originals along with /etc/CommId and /tmp/task.cron. Check every home folder for crashed.dump and CommId too.
  6. Run the checks above again. Then restart the server and check once more. Nothing should come back.
  7. If the attacker had full control (root), or you can't confirm what changed, rebuild from a fresh install and restore only data you've checked.
  8. It steals passwords, so from a clean computer, change the administrator and service passwords, SSH keys and tokens that were on the server, and cancel the old ones. Before you reconnect, switch to key logins, install all updates, and allow management services only from trusted networks.
These steps are provided as-is, without warranty. Run them at your own risk, and back up first. If you're unsure, rebuild from a known-good install.

What Minaki Scan does about it

Minaki Scan finds this threat by the fingerprints of its files and processes and removes it, but only after you type yes. It backs up what it changes and logs every change on your server.

Minaki Scan checks your server every day for this and the other threats in this wiki. $1 per server a month. Downloads open soon.

Sources

This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.