Clipbanker

Overview

Trojan:Win32/Clipbanker (often referred to as a Clipper) is a highly specialized, financially motivated trojan designed solely to monitor the Windows clipboard and seamlessly replace copied cryptocurrency wallet addresses with addresses controlled by the attacker.

Understanding Clipbanker
To the end-user, a Clipbanker infection is entirely invisible until a financial transaction fails or funds are lost. Cryptocurrency wallet addresses (e.g., Bitcoin, Ethereum, Monero) are long, complex strings of alphanumeric characters (e.g., `1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa`). Because they are impossible to memorize, users universally rely on copy-and-paste. For a threat actor, this is a massive vulnerability. Clipbanker sits silently in the background, polling the clipboard API (`T1115`). When it detects a string matching a regex pattern for a crypto wallet, it instantly swaps it with the attacker's wallet. When the user pastes the address into their exchange or transfer portal, they inadvertently send their funds directly to the cybercriminal.

Execution and Evasion Strategies
Clipbankers are frequently distributed via cracked software, malicious torrents, or as secondary payloads dropped by exploit kits. Upon execution, they are incredibly lightweight. They do not need complex network communication or process injection; their entire logic is localized to the `SetClipboardData` and `GetClipboardData` Windows APIs. They often establish persistence via simple Registry Run keys (`T1547.001`) and disguise their process names to blend in with legitimate system services.

Indicators of Compromise & Impact
The impact is immediate, irreversible financial loss. Cryptocurrency transactions cannot be charged back. Detection can be difficult because the malware generates almost no network traffic. EDR platforms may flag anomalous, continuous polling of the Clipboard API by an unrecognized, unsigned binary. The definitive IoC is a user reporting that a copied wallet address does not match the pasted wallet address.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1036.005: Monitor for executable files running from unusual paths or with deceptive names. Use EDR to detect process masquerading.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_CLIPBANKER {
    meta:
        description = "Detects Clipbanker (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "clipbanker" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Clipbanker Activity
id: fd3aeef03c6f41196fd31cd2f692fe0b
status: experimental
description: Detects generic indicators of the clipbanker malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*clipbanker*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately to prevent any further fraudulent transactions.
2. If the user is actively attempting a transaction, instruct them to halt immediately and manually verify every character of the destination address.
3. Audit the Registry Run keys (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`) to locate the persistence mechanism for the Clipper.
4. Analyze the executable to extract the hardcoded attacker wallet addresses; add these to internal threat intelligence blocklists to track the actor's funds.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume a user simply 'made a typo' when reporting misdirected crypto funds; clipboard hijacking is a massive, automated industry.
2. Avoid ignoring the incident after removing the malware; the victim must be informed that the lost funds are likely unrecoverable on the blockchain.

References & External Analysis

• Search "clipbanker" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Sohanad
• Sinowal
• Webwatcher
• Pcfixer
• Delphi

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/clipbanker.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.