

It drops the freebl3.dll file which can be found in the original installer, but its contents are different. Nevertheless, the malicious installer drops different files.

More about the malicious Tor browsers and their installersīoth malicious and original Tor Browser installers have the same design/user interface. Malicious Tor Browsers include a library infected with spyware that gathers personal information and sends it to a C2 server. Tor Browser is a legitimate browser that makes it more difficult to trace its user's Internet activity (it protects the user's privacy).

OnionPoison is the name of a campaign used to distribute malicious Tor Browser installers.
