On the plus side, it is impossible to shutdown the C&C. send an SMS to a number specified in a command.send the C&C a list of apps installed on the mobile device.send telephone data to the C&C (telephone number, country, IMEI, model, OS version).

The Trojan can receive the following commands from the C&C: The cybercriminals have added their own code to the application, though the Trojan doesn’t pass itself off as Orbot – it simply uses the functionality of the client. onion domain zone that can only be accessed in Tor.ī is a variation of the popular Orbot Tor client. As well as providing users with anonymity, Tor makes it possible to display ‘anonymous’ sites in the. The Trojan uses the anonymous Tor network built on a network of proxy servers. Now, yet another technique from Windows Trojans has been implemented in malware for Android: for the first time we have detected an Android Trojan that uses a domain in the. Virus writers of Android Trojans have traditionally used Windows malware functionality as a template.

Android malware onion tor