I wanted to add that the use of the TOR network is never very efficient and sending data through it may or may not actually make it to the CnC as it might using normal internet methods. On the other hand, bundling the TOR software with the malware means it is very heavy and would be difficult to download, transfer and operate with much stealth. On one side, using TOR makes it very difficult to shut down a CnC server and therefore, little concern over losing connection with the bots once they are installed on the mobile devices. Unuchek makes some valid points concerning the use of TOR for botnets. The current price for obtaining use of the Slempo botnet is $1,000 up front and $500 a month after that. Here are a few screenshots to show you what that looks like: Kaspersky uses the vendor name, however, we think the official name of this threat is 'Slempo' and is a variation or evolution of the 'Stoned Cat' botnet.Īdvertisements for this new 'Tor Botnet' includes all the functionality mentioned above and describes the Admin panel as being similar to the Stoned Cat interface. Request GPS coordinates and display them on Google Maps.Execution of codes remotely as well as obtaining a response from the bot.Wiretapping incoming / outgoing messages without hiding them.Interception of incoming / outgoing messages only from senders point of view.Interception and hiding of all incoming / outgoing messages.Today, an article posted by Roman Unuchek of Kaspersky described the discovery of the first ' TOR Trojan for Android' and how cyber criminals have taken the source code for Orbot, a TOR network client for Android, and modified it with malicious functionality, such as that a Bot would have. We have also seen the use of TOR, the anonymous 'under-web' used to host CnC servers with little likelihood that the owners of the servers would be discovered.Īlthough most of these advancements in botnet technology have been made specifically for the desktop, we are seeing a huge push to employ these same tactics on mobile platforms such as Android. To this end, we have seen the development of such things as DGA or Domain Generation Algorithms, which dynamically create new CnC addresses that are pre-created by the botnet owners to have their traffic move frequently to avoid detection/blocking. Botnet creators have attempted numerous tactics for hiding their presence, traffic and locations of their command and control (CnC) servers.

Fast tor vpn for android