The rise of TOR-based botnets

Jump to navigation Jump to search

(Publication) Google search: [1]

The rise of TOR-based botnets
Botnet Atrax, PTA
Botnet/malware group
Exploit kits
Distribution vector
Operation/Working group
CCProtocol Tor
Date 2013 / 2013-07-24
Editor/Conference ESET
Link (Archive copy)
Author Aleksandr Matrosov
Type Blogpost


We have been tracking the rise of Tor-based botnets this summer. In July two different malware families were detected that use the Tor hidden service protocol for stealth communication with C&C’s. The Tor hidden service protocol is well-suited to organizing stealth communication channel with a C&C but is slow for stealing high volumes of data from an infected machine. For cybercriminals the most useful way to use the hidden service protocol is for communicating with C&C, getting update for configuration information, or downloading additional malicious modules.

In July ESET researchers detected two different types of Tor-based botnets based on the malware families Win32/Atrax and Win32/Agent.PTA. Both botnets have form-grabbing functionality for possible further fraud operations. The Atrax botnet looks more complex and interesting, so we begin this blog by analysing it.


 @misc{Lua error: Cannot create process: proc_open(/dev/null): failed to open stream: Operation not permitted2013BFR1355,
   editor = {ESET},
   author = {Aleksandr Matrosov},
   title = {The rise of TOR-based botnets},
   date = {24},
   month = Jul,
   year = {2013},
   howpublished = {\url{}},