Backdoor:OSX/Tsunami.A is a distributed denial-of-service (DDoS) flooder that is also capable of downloading files and executing shell commands in an infected system.
The F-Secure security product will automatically remove the file.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note You need administrative rights to change the settings.
Backdoor:OSX/Tsunami.A is an OS X platform ported version of the IRC bot for Linux called "Kaiten wa goraku." Upon execution, it connects to an IRC server and then joins a password protected channel where it waits for further commands.
It is mainly a distributed denial-of-service (DDos) flooder, hence the name Tsunami. However, it is also capable of performing other actions such as downloading additional files and executing shell commands in an infected system. These actions could grant the bot master almost a full control of the infected system.
The IRC parameters, drop files and launch points differ between variants. As of this writing, two variants have been found. The table below describes the characteristics of the two variants.
| IRC Server:Port | Channel | Drop Files and Launch Points |
|---|---|---|
| pingu.anonops.li:6667 | #tarapia | None. It must be installed manually by the user or an attacker who has access to the system |
| x.lisp.su:6667 | #harbour | - |
| /System/Library/LaunchDaemons/com.apple.logind.plist | - | launch point |
| /usr/sbin/logind | - | copy of the malware |
As of this writing, both servers are not accessible