The rise of TOR-based botnets - Revision history

Eric.freyssinet: Text replacement - "TOR" to "Tor"

2015-08-03T16:18:57Z

Text replacement - "TOR" to "Tor"

← Older revision		Revision as of 16:18, 3 August 2015
Line 9:		Line 9:
	\|Year=2013		\|Year=2013
	\|Botnet=Atrax, PTA		\|Botnet=Atrax, PTA
	\|CCProtocol=~~TOR~~		\|CCProtocol=Tor
	\|Abstract=We have been tracking the rise of ~~TOR~~-based botnets this summer. In July two different malware families were detected that use the ~~TOR~~ hidden service protocol for stealth communication with C&C’s. The ~~TOR~~ hidden service protocol is well-suited to organizing stealth communication channel with a C&C but is slow for stealing high volumes of data from an infected machine. For cybercriminals the most useful way to use the hidden service protocol is for communicating with C&C, getting update for configuration information, or downloading additional malicious modules.		\|Abstract=We have been tracking the rise of Tor-based botnets this summer. In July two different malware families were detected that use the Tor hidden service protocol for stealth communication with C&C’s. The Tor hidden service protocol is well-suited to organizing stealth communication channel with a C&C but is slow for stealing high volumes of data from an infected machine. For cybercriminals the most useful way to use the hidden service protocol is for communicating with C&C, getting update for configuration information, or downloading additional malicious modules.

	In July ESET researchers detected two different types of ~~TOR~~-based botnets based on the malware families Win32/Atrax and Win32/Agent.PTA. Both botnets have form-grabbing functionality for possible further fraud operations. The Atrax botnet looks more complex and interesting, so we begin this blog by analysing it.		In July ESET researchers detected two different types of Tor-based botnets based on the malware families Win32/Atrax and Win32/Agent.PTA. Both botnets have form-grabbing functionality for possible further fraud operations. The Atrax botnet looks more complex and interesting, so we begin this blog by analysing it.
	}}		}}

Eric.freyssinet: Text replacement - "/ www." to "/ |Site=www."

2015-07-31T11:07:17Z

Text replacement - "/ www." to "/ |Site=www."

← Older revision		Revision as of 11:07, 31 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Type=Blogpost		\|Type=Blogpost
	\|Link=http://www.welivesecurity.com/2013/07/24/the-rise-of-tor-based-botnets/ www.welivesecurity.com		\|Link=http://www.welivesecurity.com/2013/07/24/the-rise-of-tor-based-botnets/
			\|Site=www.welivesecurity.com
	\|Author=Aleksandr Matrosov		\|Author=Aleksandr Matrosov
	\|NomRevue=We Live Security		\|NomRevue=We Live Security

Eric.freyssinet: 1 revision imported

2015-02-07T14:30:12Z

1 revision imported

← Older revision		Revision as of 14:30, 7 February 2015
(No difference)

Eric.freyssinet at 19:18, 24 July 2013

2013-07-24T19:18:15Z

New page

{{Publication
|Type=Blogpost
|Link=http://www.welivesecurity.com/2013/07/24/the-rise-of-tor-based-botnets/ www.welivesecurity.com
|Author=Aleksandr Matrosov
|NomRevue=We Live Security
|Date=2013-07-24
|Editor=ESET
|Year=2013
|Botnet=Atrax, PTA
|CCProtocol=TOR
|Abstract=We have been tracking the rise of TOR-based botnets this summer. In July two different malware families were detected that use the TOR hidden service protocol for stealth communication with C&C’s. The TOR hidden service protocol is well-suited to organizing stealth communication channel with a C&C but is slow for stealing high volumes of data from an infected machine. For cybercriminals the most useful way to use the hidden service protocol is for communicating with C&C, getting update for configuration information, or downloading additional malicious modules.

In July ESET researchers detected two different types of TOR-based botnets based on the malware families Win32/Atrax and Win32/Agent.PTA. Both botnets have form-grabbing functionality for possible further fraud operations. The Atrax botnet looks more complex and interesting, so we begin this blog by analysing it.
}}