Tordev

Overview

Trojan:Win32/Tordev is a heuristic detection for malicious software that leverages the Tor anonymity network (The Onion Router) to completely obfuscate its Command and Control (C2) communications, making it exceptionally difficult for defenders to track the origin of the threat actors or block the infrastructure.

Understanding Tordev
To the victim, the malware operates invisibly. However, for a network defender, Tordev represents a significant challenge in attribution and containment. Instead of reaching out to a standard, hardcoded IP address or domain name (which could easily be blocked by a corporate firewall), Tordev routes its traffic through a series of encrypted Tor nodes. The ultimate destination is usually a hidden service (a `.onion` address) hosted on the Dark Web.

Execution and Evasion Strategies (The Tor Hidden Service)
Tordev variants are distributed via standard mechanisms (spearphishing, exploit kits). Upon execution on the victim machine, the malware often drops a legitimate, bundled version of the `tor.exe` client (`T1105`), or it contains a statically linked Tor library (like `libtor`). It launches the Tor process silently in the background, binding it to a local port (e.g., `127.0.0.1:9050`). The malware then proxies all its exfiltration data, command requests, and payload downloads through this local Tor proxy (`T1090.003`). Because the traffic leaving the corporate network is encrypted Tor traffic, standard IDS/IPS systems cannot inspect the payload, and DNS blackholing is entirely ineffective.

Indicators of Compromise & Impact
The impact is highly secure, untraceable data exfiltration or remote control. EDR platforms should flag any unauthorized execution of `tor.exe` or unrecognized processes establishing persistent connections over typical Tor ports (TCP 9001, 9030). Network edge devices (firewalls) will show encrypted traffic destined for known Tor entry nodes. The presence of Tor configuration files (`torrc`) in unexpected directories (like `%AppData%`) is a definitive IoC.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_TORDEV {
    meta:
        description = "Detects Tordev (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "tordev" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Tordev Activity
id: eeeaf457fba72ac27f92e0176aefce9f
status: experimental
description: Detects generic indicators of the tordev malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*tordev*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network; the attacker has a highly secure, encrypted channel directly into the affected machine.
2. Ensure that corporate firewalls are configured to block all traffic to and from known Tor entry, exit, and relay nodes.
3. Identify the malicious process interacting with the Tor proxy and terminate it via EDR response actions.
4. Capture a memory dump before rebooting to extract the malware and potentially the `.onion` address it was attempting to contact.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume your edge firewall will catch the malicious payload; Tor encrypts the payload so deep packet inspection (DPI) fails.
2. Avoid allowing users to run unauthorized VPNs or proxy tools, as this masks the deployment of Tordev-like malware.

References & External Analysis

• Search "tordev" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Seznam
• Manuscrypt
• Karagany
• Hydrapos
• Nemesis

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/tordev.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.