DigitalSide Threat Intel

Tsunami.m68k

First submission 2023-09-11 11:56:02

File details

File type: ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Mime type: application/x-executable
File size: 70.69 KB (72388 bytes)
MD5: 0cc49ac3879e12ac37746bb355fad504
SHA1: 0d53a7c77a2399f28d2d9e3c4bef3a6f21bbbe4f
SHA256: 1d8a76adb50f05555cd6349d497419578731cab7bc13344752daec96b37e2bb4
Virus Total: 37/61 VT report date: 2023-09-11 09:28:19

File features detected

Is DLL

Packers

Anti Debug

Anti VM

Signed

XOR

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://80.76.51.196/bins/Tsunami.m68k VirusTotal Report 80.76.51.196 VirusTotal Report 2023-09-11 11:56:03

Strings analysis - Possible IPs found 3

192.168.0.14
80.76.51.196
127.0.0.1

Strings analysis - Possible URLs found 8

http://80.76.51.196/zyxel.sh;
http://schemas.xmlsoap.org/soap/encoding//%22%3E<s:Body
http://schemas.xmlsoap.org/soap/envelope//
http://80.76.51.196/bins/Tsunami.mips;
http://schemas.xmlsoap.org/soap/envelope/
http://schemas.xmlsoap.org/soap/encoding/
http://80.76.51.196/bins/Tsunami.x86
http://80.76.51.196/bin+-O+/tmp/gaf;sh+/tmp/gaf