[tor-talk] IRC bot using Tor ?

[Andrew Lewis]

So please ignore the previous message. 


On topic: that does not look like a tor address at first glance, but I'd have to look into it further. It looks like the address just randomly has tor in the host name. 

-Andrew


On May 18, 2012, at 11:38 AM, "David H. Lipman" <DLipman at Verizon.Net> wrote:

> :New{HU-XP-x86}5120048!5120048 at Doink-B9C30A60.tor-node.info JOIN :#arXXn#
> 
> IRC.Mixtape.Net
> 
> 
> The above lines were taken from a bot's communiication via IRC from an executable that was foisted from a PDF exploit.
> 
> I have the full communication and obfuscated :#arXXn#.
> 
> -- 
> Dave
> Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
> http://www.pctipp.ch/downloads/dl/35905.asp 
> 
> _______________________________________________
> tor-talk mailing list
> tor-talk at lists.torproject.org
> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk