A lot of ransomware and malware uses deep web services to get their key. I was wondering if they carry the Tor browser with them or if they use some other technique, as I don't think everyone has Tor installed on their system.
Malware that needs to access a website in the Tor network often employs a Tor2web service.
These free services enable you to connect to an onion site with your regular browser. They provide a gateway to the Tor network over HTTP or HTTPS and connect to Tor themselves. This way, the malware doesn't need to come with a full-blown Tor client.
One of the most popular Tor2web domains is
onion.to. You can basically append the
.to extension to almost any onion link to access it from the clearnet. E.g., a mirror of The Hidden Wiki can be accessed this way:
While Tor2web is straightforward, there are also cases where ransomware prompts victims to download the Tor browser manually themselves and some malware uses actual Tor components to obscure their C&C communication:
Malware can just as easily use Tor as anyone else. In the second half of 2013, we saw more malware making use of it to hide their network traffic. In September, we blogged about the Mevade malware that downloaded a Tor component for backup command and control (C&C) communication. In October 2013, Dutch police arrested four persons behind the TorRAT malware, a malware family which also used Tor for its C&C communication. [...]
In the last weeks of 2013, we saw some ransomware variants that called itself Cryptorbit that explicitly asked the victim to use the Tor Browser (a browser bundle pre-configured for Tor) when paying the ransom.