{
  "family": "clipbanker",
  "sample_count": 35,
  "category": "trojan",
  "description": "Trojan:Win32/Clipbanker (often referred to as a Clipper) is a highly specialized, financially motivated trojan designed solely to monitor the Windows clipboard and seamlessly replace copied cryptocurrency wallet addresses with addresses controlled by the attacker.<br><br><b>Understanding Clipbanker</b><br>To the end-user, a Clipbanker infection is entirely invisible until a financial transaction fails or funds are lost. Cryptocurrency wallet addresses (e.g., Bitcoin, Ethereum, Monero) are long, complex strings of alphanumeric characters (e.g., `1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa`). Because they are impossible to memorize, users universally rely on copy-and-paste. For a threat actor, this is a massive vulnerability. Clipbanker sits silently in the background, polling the clipboard API (`T1115`). When it detects a string matching a regex pattern for a crypto wallet, it instantly swaps it with the attacker's wallet. When the user pastes the address into their exchange or transfer portal, they inadvertently send their funds directly to the cybercriminal.<br><br><b>Execution and Evasion Strategies</b><br>Clipbankers are frequently distributed via cracked software, malicious torrents, or as secondary payloads dropped by exploit kits. Upon execution, they are incredibly lightweight. They do not need complex network communication or process injection; their entire logic is localized to the `SetClipboardData` and `GetClipboardData` Windows APIs. They often establish persistence via simple Registry Run keys (`T1547.001`) and disguise their process names to blend in with legitimate system services.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is immediate, irreversible financial loss. Cryptocurrency transactions cannot be charged back. Detection can be difficult because the malware generates almost no network traffic. EDR platforms may flag anomalous, continuous polling of the Clipboard API by an unrecognized, unsigned binary. The definitive IoC is a user reporting that a copied wallet address does not match the pasted wallet address.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1112",
    "T1036.005",
    "T1115",
    "T1204.002",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1115",
      "name": "Clipboard Data",
      "tactic": "Collection"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent any further fraudulent transactions.",
    "If the user is actively attempting a transaction, instruct them to halt immediately and manually verify every character of the destination address.",
    "Audit the Registry Run keys (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) to locate the persistence mechanism for the Clipper.",
    "Analyze the executable to extract the hardcoded attacker wallet addresses; add these to internal threat intelligence blocklists to track the actor's funds."
  ],
  "what_to_avoid": [
    "Do not assume a user simply 'made a typo' when reporting misdirected crypto funds; clipboard hijacking is a massive, automated industry.",
    "Avoid ignoring the incident after removing the malware; the victim must be informed that the lost funds are likely unrecoverable on the blockchain."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}