Home > Threat descriptions >



Category: Malware

Type: Trojan

Platform: Android

Aliases: Trojan:Android/Torsm, Android.Torec.A, Android/Torec.A, Torec, Andr/SMSTor-A, Backdoor.AndroidOS.Torec.a


Trojan:Android/Torsm.A is reportedly the first trojan to use the open-source, anonymizing Tor network to hide its communications with its Command & Control (C&C) structure. When active, the trojan monitors and intercepts incoming SMS messages, as well as sends SMSes to a specified number.


Automatic action

Once the scan is complete, the F-Secure security product will prompt you to assess the file and choose to Uninstall, Quarantine or keep it installed on your device.

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

When installed, Trojan:Android/Torsm.A will monitor and intercept incoming SMS messages and forward them to a number that can be specified in instructions sent via the C&C server. It can also harvest information from the device, including the phone number, device model and a list of installed apps.

Torsm.A is notable for the way it communicates with the attacker(s) controlling its operations, as the C&C server used by the operators is within the anonymizing Tor network. This makes it extremely difficult for security researchers and law enforcement authorities to takedown the server. Though this technique has been previously used with PC-based malware, this is the first known instance of an Android malware using the same technique to hide its communications.

The code for the Torsm trojan was reportedly based on the available, open-source Orbot Tor client, with additional code to enable the trojan's malicious functions. For more information, see: