Loading malware…
OCRFix is a Windows malware/botnet family delivered via ClickFix-style social engineering (fake CAPTCHA/verification pages) that tricks users into pasting clipboard-staged commands (PowerShell or Windows Run) to bootstrap execution and install an MSI dropper. Multiple reports in the provided content describe OCRFix using “EtherHiding”/blockchain-based C2 resolution: infected hosts query smart contracts on BNB Smart Chain (including BSC testnet in several described cases) via JSON-RPC (eth_call / ERC20 name() or a custom getter selector) at runtime to retrieve encrypted or plaintext C2 URLs, enabling rapid C2 rotation by updating on-chain data without changing binaries.
Two distinct but similarly branded OCRFix activity descriptions are present:
Infection vectors and lures mentioned include typosquatting/impersonation of Tesseract OCR, SEO poisoning, a YouTube video promoting the fake instructions, and claims of “LLM poisoning” where ChatGPT recommended the malicious site. Known network/IOC details explicitly mentioned in the content include: h01-captcha.sbs; finger.cldvrfd.click / on.cldvrfd.click (port 79) and 178.16.52.168; vrf.cldvrfd.click; opsecdefcloud[.]com (serving 98166e51.msi); ldture[.]com (panel); BSC testnet JSON-RPC endpoints; the smart contract addresses listed above; and final-stage endpoint rec.allthe.site/chk.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
OCRFix is a three-stage botnet that stores its C2 URLs inside BNB Smart Chain testnet smart contracts. Each stage queries a contract via JSON-RPC at runtime to get the current C2 domain.
OCRFix is a three-stage botnet that stores its C2 URLs inside BNB Smart Chain testnet smart contracts. Each stage queries a contract via JSON-RPC at runtime to get the current C2 domain.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Checks the machine UUID via WMI ( Win32_ComputerSystemProduct )... Checks for an existing CfgHelper.exe process via WMI Win32_Process
Creates two scheduled tasks at HIGHEST RunLevel: CfgHelper running CfgHelper.exe every 30 minutes CfgMgr running CfgMgr.exe every 5 minutes
setup_helper.exe <- STAGE 2 +-- powershell.exe (UAC elevation loop) +-- setup_helper.exe <- STAGE 2 (elevated) |-- powershell.exe (Defender exclusions)
All three stages are VBScript payloads compiled with VBSEdit and obfuscated with Chr() / CLng() / Xor arithmetic expressions.
obfuscated with Chr() / CLng() / Xor arithmetic expressions... base64-encoded in the DLL's .rsrc section
Every 25 minutes, the bot scans %programdata%\app_config\ for subdirectories starting with C and deletes any older than 20 minutes.
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as prior malware/campaign using a similar EtherHiding smart-contract-based C2 configuration technique.
Botnet with samples observed hiding command-and-control infrastructure on the BNB blockchain.
A three-stage VBScript-based botnet delivered via a ClickFix fake-CAPTCHA copy/paste PowerShell flow that installs an MSI dropper. Stage 1 downloads Stage 2; Stage 2 performs UAC elevation, adds Defender exclusions, and establishes persistence via scheduled tasks; Stage 3 is the bot that beacons every 60 seconds to a PHP panel, executes cmd/file tasks, and can download/execute additional payloads. C2 resolution is performed via BNB Smart Chain testnet smart contracts (EtherHiding-style), enabling rapid C2 rotation without updating binaries.
ClickFix campaign delivering malware that leverages EtherHiding to resolve/retrieve C2 infrastructure, exfiltrate system information, and await commands.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.