MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Tsunami


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13
SHA3-384 hash: eddbefff53f58ebe413ab4cb6d11f5dd8fef8d5501c7e6e71bf43c0bb0812e3c90dbcd355607250902c71515135c8787
SHA1 hash: ac3449f4ff85338a4cc99581070f358fb30ce1a1
MD5 hash: 8d4a6b005fe1b8b6ab08ac9501a13110
humanhash: juliet-ten-wolfram-high
File name:irq0
Download: download sample
Signature Tsunami
Create hunting rule
File size:619'847 bytes
First seen:2024-10-22 16:05:54 UTC
Last seen:2024-10-22 16:23:08 UTC
File type: elf
MIME type:application/x-executable
ssdeep 12288:To2aovPAC2u24h68Qugl3qCiJ7o6xt95DujbUjWWkGHnon3MYNBEEx9IRXa:8IvPAC2utTQug7iJ7oOtO3UjLkConLfx
TLSH T10FD423429CC7D882B5AA5FAECCC6885D2B74C4B424E38DB0414FB0A1D9C69DF953A4F7
Magika elf
Reporter abuse_ch
Tags:elf Tsunami

Intelligence

File Origin
# of uploads :
2
# of downloads :
333
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Siggen.8166.14789.28851.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=671854f19e67c24682034f14
Tags:
Tsunami
Result
Verdict:
Malware
Maliciousness:

Behaviour
Deleting a recently created file
Connection attempt
Creating a file
Receives data from a server
Deletes a file
Changes access rights for a written file
Attempts to kill processes by name
Launching a process
Changes the time when the file was created, accessed, or modified
Opens a port
Sends data to a server
Manages services
Kills critical processes
Creates or modifies files in /cron to set up autorun
Creates or modifies files to set up autorun
Creates or modifies files in /init.d to set up autorun
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
tsunami
Link:
https://www.filescan.io/uploads/6717cd75c7aed0374dacaed5/reports/219753b2-ba16-47c4-b50a-866c951f4472/overview
Verdict:
Malicious
Uses P2P?:
false
Uses anti-vm?:
false
Architecture:
arm
Packer:
custom
Botnet:
unknown
Number of open files:
2
Number of processes launched:
0
Processes remaning?
false
Remote TCP ports scanned:
not identified
Full report:
https://elfdigest.com/brief/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13
Behaviour
no suspicious findings
Botnet C2s
TCP botnet C2(s):
not identified
UDP botnet C2(s):
not identified
Gathering data
Result
Threat name:
Tsunami
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1539464
Signature
Antivirus / Scanner detection for submitted sample
Executes the "crontab" command typically for achieving persistence
Explicitly modifies time stamps using the "touch" command
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sample tries to persist itself using cron
Terminates several processes with shell command 'killall'
Tries to read the SSH 'known_hosts' file
Tries to read the SSH config file
Tries to read the SSH private key file
Uses IRC for communication with a C&C
Uses known network protocols on non-standard ports
Yara detected Tsunami
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1539464 Sample: irq0.elf Startdate: 22/10/2024 Architecture: LINUX Score: 100 127 220.247.127.24, 22, 33362 VECTANTARTERIANetworksCorporationJP Japan 2->127 129 220.218.101.61, 22, 42626 UCOMARTERIANetworksCorporationJP Japan 2->129 131 99 other IPs or domains 2->131 141 Malicious sample detected (through community Yara rule) 2->141 143 Antivirus / Scanner detection for submitted sample 2->143 145 Multi AV Scanner detection for submitted file 2->145 147 3 other signatures 2->147 14 irq0.elf 2->14         started        signatures3 process4 process5 16 irq0.elf 14->16         started        18 irq0.elf sh 14->18         started        20 irq0.elf sh 14->20         started        22 8 other processes 14->22 file6 25 irq0.elf 16->25         started        27 irq0.elf 16->27         started        29 irq0.elf 16->29         started        41 18 other processes 16->41 31 sh crontab 18->31         started        35 sh 20->35         started        121 /run/.x00740882966, ASCII 22->121 dropped 37 sh touch 22->37         started        39 sh touch 22->39         started        43 5 other processes 22->43 process7 file8 45 irq0.elf 25->45         started        58 156 other processes 25->58 48 irq0.elf sh 27->48         started        50 irq0.elf sh 29->50         started        123 /var/spool/cron/crontabs/tmp.3qSs8I, ASCII 31->123 dropped 133 Sample tries to persist itself using cron 31->133 135 Executes the "crontab" command typically for achieving persistence 31->135 60 4 other processes 35->60 137 Explicitly modifies time stamps using the "touch" command 37->137 52 sh killall 41->52         started        54 sh killall 41->54         started        56 sh killall 41->56         started        62 13 other processes 41->62 125 /etc/inittab, ASCII 43->125 dropped signatures9 process10 signatures11 149 Tries to read the SSH private key file 45->149 151 Tries to read the SSH 'known_hosts' file 45->151 153 Tries to read the SSH config file 45->153 64 sh sudo 48->64         started        66 sh 50->66         started        155 Terminates several processes with shell command 'killall' 52->155 157 Executes the "crontab" command typically for achieving persistence 60->157 68 service 62->68         started        70 service 62->70         started        72 service 62->72         started        74 11 other processes 62->74 process12 process13 76 sh sudo 64->76         started        78 sh service systemctl 64->78         started        80 sudo systemctl 64->80         started        82 sh killall 66->82         started        89 2 other processes 66->89 85 service systemctl 68->85         started        87 service sed 68->87         started        91 2 other processes 70->91 93 2 other processes 72->93 signatures14 95 sudo service systemctl 76->95         started        97 service 78->97         started        99 service basename 78->99         started        101 service basename 78->101         started        103 service systemctl 78->103         started        139 Terminates several processes with shell command 'killall' 82->139 process15 process16 105 service 95->105         started        107 service basename 95->107         started        109 service basename 95->109         started        111 service systemctl 95->111         started        113 service systemctl 97->113         started        115 service sed 97->115         started        process17 117 service systemctl 105->117         started        119 service sed 105->119         started       
Score:
100%
Verdict:
Malware
File Type:
ELF
Link:
https://malprob.io/report/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-09-28 00:55:10 UTC
File Type:
ELF32 Little (Exe)
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uzg5vipdor5rbbr26o3a46n354jjljy77xz52fndsdkze2tmhqjq._file
Result
Malware family:
kaiten
Create hunting rule
Score:
  10/10
Tags:
family:kaiten botnet defense_evasion discovery execution persistence privilege_escalatio
Link:
https://tria.ge/reports/241022-tj3gzatbkg/
Behaviour
Reads runtime system information
Indicator Removal: Timestomp
Creates/modifies Cron job
Enumerates running processes
Detects Kaiten/Tsunami Payload
Kaiten/Tsunami
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/19bd1d89-4ceb-436f-ab6c-f04e2337ec3f
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:enterpriseapps2
Create hunting rule
Author:Tim Brown @timb_machine
Description:Enterprise apps
Rule name:linux_generic_ipv6_catcher
Create hunting rule
Author:@_lubiedo
Description:ELF samples using IPv6 addresses
Rule name:unixredflags3
Create hunting rule
Author:Tim Brown @timb_machine
Description:Hunts for UNIX red flags

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Tsunami

sh 49dff6cc2bf001c1cafdfb571d2f883887be92fcec7862ac61fb5852530c2fad

Tsunami

elf a64ddaa1e3747b10863af3b60e79bbef1295a71ffdf3dd15a390d5926a6c3c13

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3248724/
  
Delivery method
Distributed via web download
  
Dropped by
SHA256 49dff6cc2bf001c1cafdfb571d2f883887be92fcec7862ac61fb5852530c2fad
  
Dropped by
MD5 7613a386b78031232bae5d140a1441b6

Comments