Large botnet cause of recent Tor network overload

This report analyzes a widespread botnet (Mevade/Sefnit, aka SBC) that migrated its command-and-control to Tor (.onion over HTTP), causing a large surge in Tor clients; it documents the Tor module version (0.2.3.25), installation paths, sample URL, and multiple MD5 indicators, and assesses the botnet as large-scale and likely financially motivated.