OCRFix Botnet Uses ClickFix Phishing and EtherHiding to Mask Blockchain C2 Infrastructure
The OCRFix campaign is a multi-stage botnet Trojan that exploits a fake Tesseract OCR download site. It incorporates ClickFix-style PowerShell execution and EtherHiding on the BNB Smart Chain to obscure a rotating blockchain-backed command infrastructure.
The OCRFix campaign is a multi-stage botnet Trojan that exploits a fake Tesseract OCR download site. It incorporates ClickFix-style PowerShell execution and EtherHiding on the BNB Smart Chain to obscure a rotating blockchain-backed command infrastructure.
The fake site presents a CAPTCHA and instructs users to execute a PowerShell command, a common feature in ClickFix campaigns that exploit user interaction to authorize malicious script execution. The PowerShell command decodes data and reconstructs strings to download an MSI installer from opsecdefcloud[.]com, deploying the first-stage payload.
CYJAX identified a typosquatting domain imitating Tesseract OCR, which is an open-source OCR engine typically distributed via GitHub. Post-execution, users are redirected to legitimate Tesseract documentation and GitHub content.
Notably, OCRFix employs EtherHiding, where command and control (C2) information is embedded within smart contracts on public blockchains rather than being hardcoded into binaries. This approach uses BNB Smart Chain TestNet contracts to store key data, querying these contracts via services like PublicNode to recover C2 URLs. This method complicates static detection and allows for rapid infrastructure rotation when domains are blocked.
Stage One: A loader (Update1.exe) queries the BNB TestNet contract for a C2 URL, downloads an encrypted archive, and unpacks a second-stage executable. Stage Two: The executable (setup_helper.exe) establishes persistence, disables security features, and polls blockchain-derived C2 endpoints. Stage Three: Turns the host into a bot listener, communicating with a bot server every 60 seconds.
The C2 host exposes a web-based bot management panel, which lacks robust authentication, allowing analysts to inspect much of its client-side structure. This panel tracks active bots and offers a task creation capability to deploy additional payloads.
Type IOC Description
Domain ldture.com Bot control panel domain
The OCRFix campaign is a multi-stage botnet Trojan that exploits a fake Tesseract OCR download site.
Domain dltruek.com C2 domain
Domain oklefe.com Alternative bot control panel domain
Domain ldveriz.com Alternative bot control panel domain
Domain dltucra.com C2 domain
Domain tesseract-ocr.com Initial phishing page
Domain opsecdefcloud.com Hosting page for initial MSI file
Domain bsc-testnet.publicnode.com EtherHiding address
Domain checkpointviewzen.com Domain in PowerShell script
SHA1 507e814c39b200b05f596d9569675aeb6c25ab4a Initial MSI file that drops first payload: 98166e51.msi
SHA1 af6bbae2933e65d632f4f4624315c00d205bf6f7 First payload DLL: Updater1.dll
SHA1 4496afeb004df243b656d620f76ffdceef00b345 VBSedit Launcher used to run malicious DLLs
SHA1 c519a422d68e8d93f2b98ecb3fa064398045535e Secondary payload DLL: setup_helper.dll
SHA1 96f2c607aec4432ccc7b762f9927c91ee04fb0e3 Final malware payload DLL: CfgHelper.dll
Based on reporting by GBHackers.