
This service is started every time Windows starts and is configured to accept connections on TCP ports 90.

Specifically, we’ll talk about how Trojan:Win32/Sefnit.AT communicates with the Tor network, what domains it tries to contact, and where it keeps its configuration data.Īfter Sefnit installs the Tor-based malware component, which is typically named wins.exe, a copy of a non-malicious Tor client is also installed and added as a Windows service. In this post we’d like to introduce some of the details regarding the Tor component’s configuration and its communication with the Tor service. We have talked about the impact that resulted from the Sefnit botnet Tor hazard as well as the clean-up effort that went into that threat.


Microsoft Defender External Attack Surface Management.Microsoft Defender Cloud Security Posture Mgmt.Microsoft Defender Vulnerability Management.Azure Active Directory part of Microsoft Entra.
