Orchard
Aliases: Antavmu
- First seen
- 2020-02-21 00:00:00
- Malware type
- botnet, cryptominer
- Family
- Malware family
- Profile updated
- 2026-07-07 15:14:36
Context
A malware generating DGA domains seeded by the Bitcoin Genesis Block. This family has strong code overlap with win.victorygate.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Orchard_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Orchard (report)
- malverse.it — Stack String Decryptor Con Ghidra Emulator Orchard (report)
- blog.netlab.360.com — Orchard Dga (report)
- blog.netlab.360.com — A New Botnet Orchard Generates Dga Domains With Bitcoin Transaction Information (report)
- bin.re — A Dga Seeded By The Bitcoin Genesis Block (report)