Sefnit

Overview

Trojan:Win32/Sefnit (often tracked as the **Mevade** botnet) was a massive, highly sophisticated botnet that infected millions of machines globally between 2013 and 2014. Sefnit is historically significant in threat intelligence because it was one of the first major botnets to transition its entire Command and Control (C2) infrastructure to the Tor anonymity network. It was primarily utilized for large-scale click fraud, Bitcoin mining, and acting as a proxy network.

Understanding Sefnit (Mevade)
To an infected user, Sefnit was generally invisible unless the CPU-intensive Bitcoin mining module was active, causing severe system slowdowns. For security analysts and law enforcement, Sefnit was a massive headache. By routing all C2 communications through Tor hidden services (`.onion` addresses), the operators effectively blinded traditional network intrusion detection systems (IDS) and prevented researchers from easily taking down the C2 servers or sinkholing the botnet.

Execution and Tor Integration Mechanics
Sefnit was distributed aggressively via Pay-Per-Install (PPI) networks, often bundled with pirated software or adware (`T1189`). Upon execution, the payload establishes persistence via Registry Run keys (`T1547.001`) and Scheduled Tasks. Crucially, Sefnit drops a customized, statically compiled version of the Tor client (`T1090.003`). It configures this Tor client to run silently in the background (`T1543`), establishing an encrypted circuit. The core Sefnit trojan then communicates with its controllers exclusively over this Tor tunnel, receiving instructions to download Bitcoin mining modules (`T1496`), perform click fraud, or download secondary payloads.

Indicators of Compromise & Impact
The impact ranged from severe performance degradation (due to mining) to network abuse (click fraud). The primary IoC was network-based: analysts observed thousands of enterprise endpoints suddenly establishing connections to known Tor entry nodes. Host-based IoCs include the presence of Tor client executables (often renamed) running from `%AppData%` or `%Temp%`, and sustained, high CPU utilization from unknown processes.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SEFNIT {
    meta:
        description = "Detects Sefnit (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "sefnit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Sefnit Activity
id: daa704fac8db46a274b8504d1319c3c4
status: experimental
description: Detects generic indicators of the sefnit malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*sefnit*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint from the network to sever the Tor connection and halt the mining/click-fraud activities.
2. Audit firewall and proxy logs for any unexpected connections to Tor entry nodes; if Tor is not used legitimately in the enterprise, these are strong indicators of Sefnit or similar malware.
3. Use EDR to identify and terminate the hidden Tor client process and the core Sefnit botnet agent.
4. Remove the persistence mechanisms (Scheduled Tasks and Registry Run keys) established by the malware.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume standard IP blacklists will stop the C2 communication; Sefnit's use of Tor means the C2 server's true IP is hidden.
2. Avoid ignoring high CPU utilization alerts, as they are often the only visible symptom of the resource hijacking (mining) module.

References & External Analysis

• Search "sefnit" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Sasfis
• Loki
• Be3Auestydmi
• Vbcryptent
• Webbrowserpassview

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/sefnit.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.