The rise of TOR-based botnets

(Publication) Google search: [1]

The rise of TOR-based botnets
Botnet	Atrax, PTA
Malware
Botnet/malware group
Exploit kits
Services
Feature
Distribution vector
Target
Origin
Campaign
Operation/Working group
Vulnerability
CCProtocol	TOR
Date	2013 / 2013-07-24
Editor/Conference	ESET
Link	http://www.welivesecurity.com/2013/07/24/the-rise-of-tor-based-botnets/ (Archive copy)
Author	Aleksandr Matrosov
Type	Blogpost

Abstract

“ We have been tracking the rise of TOR-based botnets this summer. In July two different malware families were detected that use the TOR hidden service protocol for stealth communication with C&C’s. The TOR hidden service protocol is well-suited to organizing stealth communication channel with a C&C but is slow for stealing high volumes of data from an infected machine. For cybercriminals the most useful way to use the hidden service protocol is for communicating with C&C, getting update for configuration information, or downloading additional malicious modules.

In July ESET researchers detected two different types of TOR-based botnets based on the malware families Win32/Atrax and Win32/Agent.PTA. Both botnets have form-grabbing functionality for possible further fraud operations. The Atrax botnet looks more complex and interesting, so we begin this blog by analysing it.

Bibtex

 @misc{2013BFR1355,
   editor = {ESET},
   author = {Aleksandr Matrosov},
   title = {The rise of TOR-based botnets},
   date = {24},
   month = Jul,
   year = {2013},
   howpublished = {\url{http://www.welivesecurity.com/2013/07/24/the-rise-of-tor-based-botnets/}},
 }