{"id":"5d132fb6ec6fac12f01687f2c0375353","title":"Tor 客户端 — Tor 客户端 · 木马/恶意软件 · PE64","md5":"5d132fb6ec6fac12f01687f2c0375353","sha256":"6b866c187a0dee2fb751a8990d50dc1ed83f68e025720081e4d8e27097067dc8","family":"Tor 客户端","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"C++","file_format":"PE64","compiler":"MinGW","published_at":"2026-08-10T16:00:00.000Z","summary":"该样本为 Tor 匿名网络客户端 (PE64, MinGW 编译, 8.7MB)。Tor 是合法的匿名通信工具，使用洋葱路由技术隐藏用户 IP 地址。所有 16 个 URL 均指向 torproject.org 官方域名，包括 bridges.torproject.org、blog.torproject.org、bugs.torproject.org 等。导入 DLL 包括 KERNEL32.dll、WS2_32.dll、ADVAPI32.dll、IPHLPAPI.DLL、SHELL32.dll、USER32.dll — 典型的 Tor 网络工具依赖。检测到 VirtualAlloc/LoadLibrary/GetProcAddress 动态 API 解析 — Tor 用于插件加载，非恶意动态解析。无持久化机制、无进程注入、无窃密行为、无 C2 通信。判定为合法工具，非恶意软件。","url":"https://zseceye.com/report/5d132fb6ec6fac12f01687f2c0375353","json_url":"https://zseceye.com/report/5d132fb6ec6fac12f01687f2c0375353.json","html_url":"https://zseceye.com/report/5d132fb6ec6fac12f01687f2c0375353","hash_urls":{"md5":"https://zseceye.com/hash/5d132fb6ec6fac12f01687f2c0375353","sha256":"https://zseceye.com/hash/6b866c187a0dee2fb751a8990d50dc1ed83f68e025720081e4d8e27097067dc8"},"search_urls":{"md5":"https://zseceye.com/?q=5d132fb6ec6fac12f01687f2c0375353","sha256":"https://zseceye.com/?q=6b866c187a0dee2fb751a8990d50dc1ed83f68e025720081e4d8e27097067dc8"},"sample_download_url":"https://zseceye.com/report/5d132fb6ec6fac12f01687f2c0375353/sample","sample_filename":"6b866c18.zip","iocs":[],"ips":[]}