[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-bugs] #13479 [general]: Probable malware being served from thetorproject.org
#13479: Probable malware being served from thetorproject.org
-------------------------+-------------------------------------------------
Reporter: donncha | Owner: phobos
Type: defect | Status: assigned
Priority: normal | Milestone:
Component: general | Version:
Resolution: | Keywords: trademark violation, phishing,
Actual Points: | malware
Points: | Parent ID:
-------------------------+-------------------------------------------------
Comment (by donncha):
If looked at this site a bit more and it appears to be the same
person/group who was running Torbundlebrowser.org a few months ago.
The backdoored tor-chat.org and thetorproject.org binaries both seem to be
droppers for the following payload.
https://malwr.com/analysis/MGNmZTg0ZjIwYTQxNDJmMzg4NDJlODg5OTcwNjBhYzM/#
This payload looks to be the same type as the one which was hosted on
Torbundlebrowser.org. jvoisin reversed and described it at
http://dustri.org/b/torbundlebrowserorg.html. In this case the malware
appears to be communicated back to a C&C server listening on
gbqi75ukulafpnsd.onion:24576 but I haven't investigated this fully yet.
I've reported both domains to Google's malicious website database so
hopefully they will be added to the block lists soon.
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13479#comment:3>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs