Difference between revisions of "The rise of TOR-based botnets"
m (Text replacement - "/ www." to "/ |Site=www.") |
m (Text replacement - "TOR" to "Tor") |
||
Line 9: | Line 9: | ||
|Year=2013 | |Year=2013 | ||
|Botnet=Atrax, PTA | |Botnet=Atrax, PTA | ||
|CCProtocol= | |CCProtocol=Tor | ||
|Abstract=We have been tracking the rise of | |Abstract=We have been tracking the rise of Tor-based botnets this summer. In July two different malware families were detected that use the Tor hidden service protocol for stealth communication with C&C’s. The Tor hidden service protocol is well-suited to organizing stealth communication channel with a C&C but is slow for stealing high volumes of data from an infected machine. For cybercriminals the most useful way to use the hidden service protocol is for communicating with C&C, getting update for configuration information, or downloading additional malicious modules. | ||
In July ESET researchers detected two different types of | In July ESET researchers detected two different types of Tor-based botnets based on the malware families Win32/Atrax and Win32/Agent.PTA. Both botnets have form-grabbing functionality for possible further fraud operations. The Atrax botnet looks more complex and interesting, so we begin this blog by analysing it. | ||
}} | }} |
Latest revision as of 18:18, 3 August 2015
(Publication) Google search: [1]
The rise of TOR-based botnets | |
---|---|
Botnet | Atrax, PTA |
Malware | |
Botnet/malware group | |
Exploit kits | |
Services | |
Feature | |
Distribution vector | |
Target | |
Origin | |
Campaign | |
Operation/Working group | |
Vulnerability | |
CCProtocol | Tor |
Date | 2013 / 2013-07-24 |
Editor/Conference | ESET |
Link | http://www.welivesecurity.com/2013/07/24/the-rise-of-tor-based-botnets/ (Archive copy) |
Author | Aleksandr Matrosov |
Type | Blogpost |
Abstract
“ We have been tracking the rise of Tor-based botnets this summer. In July two different malware families were detected that use the Tor hidden service protocol for stealth communication with C&C’s. The Tor hidden service protocol is well-suited to organizing stealth communication channel with a C&C but is slow for stealing high volumes of data from an infected machine. For cybercriminals the most useful way to use the hidden service protocol is for communicating with C&C, getting update for configuration information, or downloading additional malicious modules.
In July ESET researchers detected two different types of Tor-based botnets based on the malware families Win32/Atrax and Win32/Agent.PTA. Both botnets have form-grabbing functionality for possible further fraud operations. The Atrax botnet looks more complex and interesting, so we begin this blog by analysing it.
Bibtex
@misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2013BFR1355, editor = {ESET}, author = {Aleksandr Matrosov}, title = {The rise of TOR-based botnets}, date = {24}, month = Jul, year = {2013}, howpublished = {\url{http://www.welivesecurity.com/2013/07/24/the-rise-of-tor-based-botnets/}}, }