Overview

overview

6

Static

static

1

ksoftirqd0

ubuntu-18.04-amd64

6

Analysis

  • max time kernel
    125s
  • max time network
    129s
  • platform
    ubuntu-18.04_amd64
  • resource
    ubuntu1804-amd64-20260513-en
  • resource tags

    arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
  • submitted
    22/06/2026, 01:14

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ksoftirqd0
  • Size 1.8MB
  • Sample260622-bl3lmsg15w
  • SHA256 7cc605b5fffa1478a286c2479f7c6f947fbf1ddf44bbf72f3028b4d62bb08dcb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Creates/modifies Cron job 1 TTPs 1 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to tmp directory 2 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/ksoftirqd0
    /tmp/ksoftirqd0
    1⤵
    • Enumerates kernel/hardware configuration
    PID:1501
    • /tmp/ksoftirqd0
      /tmp/ksoftirqd0
      2⤵
      • Enumerates kernel/hardware configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:1512
      • /usr/bin/crontab
        crontab -l
        3⤵
          PID:1521
        • /bin/bash
          bash -c "(crontab -l 2>/dev/null; echo '* * * * * pgrep -x ksoftirqd0 > /dev/null || /tmp/ksoftirqd0 > /dev/null 2>&1 &') | crontab -"
          3⤵
            PID:1522
            • /usr/bin/crontab
              crontab -
              4⤵
              • Creates/modifies Cron job
              PID:1524
            • /usr/bin/crontab
              crontab -l
              4⤵
                PID:1525

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              .ICEauth
              • Path /tmp/.ICE-unix/.ICEauth
              • Size 4B
              • SHA256 61189e415afd30927159fc90f39546489ff3f93fb0a54bccd8068711c56677fb
              • MD5 SHA1 SHA512
              Submit Download

              .font0-lock
              • Path /tmp/.font-unix/.font0-lock
              • Size 4B
              • SHA256 66c03337b22c301d55a339a94165dc09628491c3dfe01a57ef62e3eab452e898
              • MD5 SHA1 SHA512
              Submit Download

              tmp.rYMhCA
              • Path /var/spool/cron/crontabs/tmp.rYMhCA
              • Size 255B
              • SHA256 6c44f30c5fd1df518f1df9765652b79b82513e86b8fac7f7f701e26979501a3e
              • MD5 SHA1 SHA512 TLSH
              Submit Download