[skeptre]

HI,

I read an interesting article the other day through a post on this forum
Original Article
Forum Post

The article states that the malware uses Tor hidden service to communicate with the server for commands. A line in the article states
"We managed to patch and hijack the malware and make it connect to an IRC server hosted behind a Tor Hidden Service that we created uniquely for testing purposes"

Any idea how they were able to do it ? I wanted to try the stuff mentioned in the article. Any help would be appreciated.

Thanks

[Xylitol]

Sample: http://www.kernelmode.info/forum/viewto ... 22&p=17093

(almost 15MB)
The core code base composes a very simple Tor-enabled IRC bot which incorporates DDoS and a few other capabilities.

The malware comes along with 4 additional embedded resources:
A ZeuS bot.
The Tor client for Windows.
The CGMiner bitcoin mining tool.
A copy of OpenCL.dll, used by CGMiner for CPU and GPU hash cracking.