About tor-based botnets
This thing isn't that hard to accomplish. Before I jump into how it's done, I would like to mention that such botnet is hard to be taken down, so you are at least 90% safe, if not 100%. Now now, you need to have programming knowledge, and you need to know how the botnet actually works, so then you will be able to understand the junk I wrote down here: First things first, you need to download the tor browser then grab the tor.exe including all its DLLs from the folder, you don't need the folders, just files with the .exe Some picture of necessary files:
Then, you make a project which extracts that thing, which you will upload somewhere or just extract it, or even load it into memory like Pros out there do. Alright, you should be cautious that you need to check for available ports which will be used by tor.exe, so you need a function to retrieve that 3 ports (yes, 3 of them). You should run the tor.exe with following command: tor.exe --HTTPTunnelPort port_0 -f "torrc" (Example command would look like this: tor.exe --HTTPTunnelPort 4095 -f "C:\Users\etc\AppData\Roaming\TorData\torrc-file") You may change the "torrc" to anything you wish, like "D:\mytorrc" etc, it should contain something like this: SocksPort port_1 ControlPort port_2 DataDirectory tor_data Now then, you need "tor_data" to be some writable location on filesystem (put tor.exe there if you aren't doing injection). (So the torrc would look like this when saved: SocksPort 4096 ControlPort 4097 DataDirectory C:\Users\etc\AppData\Roaming\TorData) After that part being done, you will run tor.exe and track its console log for "Bootstrapped 100%" once that step is done - you will be able to access your botnet files.