{
  "family": "clipbanker",
  "sample_count": 35,
  "category": "banking_trojan",
  "description": "Clipbanker (extensively cataloged across threat intelligence databases and antivirus vendors under signatures including Trojan-Banker.Win32.ClipBanker, Trojan:Win32/ClipBanker, and Trojan.ClipBanker) is a notorious family of financial trojans and cryptocurrency clipboard hijackers active since 2015. Operating silently on infected endpoints, Clipbanker monitors the Windows clipboard using native API hooks (SetClipboardViewer or AddClipboardFormatListener). Whenever a user copies a string of text, Clipbanker runs regular expression algorithms to detect cryptocurrency wallet addresses (Bitcoin, Ethereum, Monero, Litecoin, Ripple) or European bank account numbers (IBANs). The moment a target address is detected, Clipbanker instantly substitutes it with a preconfigured attacker-controlled wallet or account address. Because users rarely verify every character of long hexadecimal crypto addresses before clicking 'Send', funds are irreversibly transferred directly to the threat actor.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan-Banker.Win32.ClipBanker",
    "Trojan:Win32/ClipBanker",
    "Trojan.ClipBanker",
    "Win32/ClipBanker",
    "ClipBanker.Gen",
    "Trojan-Banker:Win32/ClipBanker.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan-Banker.Win32.ClipBanker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clipbanker is a clipboard-hijacking trojan that replaces copied cryptocurrency wallet addresses and bank account numbers with attacker-controlled destinations."
      }
    },
    {
      "@type": "Question",
      "name": "How does Clipbanker steal cryptocurrency funds?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It intercepts Windows clipboard operations in real time using regex matching, swapping the victim's intended destination wallet address with an attacker wallet during copy-paste."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptocurrency formats does Clipbanker target?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It commonly targets Bitcoin (BTC), Ethereum (ETH), Litecoin (LTC), Monero (XMR), Ripple (XRP), and European IBAN bank accounts."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Clipbanker difficult for users to notice?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It generates virtually zero CPU overhead, does not display any user interface, and relies on users failing to double-check long cryptographic strings before approving transfers."
      }
    },
    {
      "@type": "Question",
      "name": "How can users protect cryptocurrency transactions from Clipbanker?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Always verify the first and last five characters of crypto wallet addresses before sending, use hardware wallets with on-device address confirmation, and maintain updated antivirus protection."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1115",
    "T1547.001",
    "T1082",
    "T1027",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Cryptocurrency Trading Bots",
    "Phishing Spam with Malicious Attachments",
    "Software Keygens & Cracks"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Clipboard API Monitoring & Real-Time Swapping",
    "Regex Pattern Matching for Crypto Wallets (BTC, ETH, XMR, LTC)",
    "IBAN Financial String Interception",
    "Persistence via Registry Autostart Keys",
    "Anti-Analysis & Sleep Delay Evasion"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (C++/Delphi)",
      "Background Service"
    ],
    "network_signatures": [
      "Periodic HTTP/HTTPS check-ins to C2 servers to fetch updated attacker wallet lists",
      "Encrypted beaconing exfiltrating the count of successful clipboard swap substitutions"
    ],
    "evasion_techniques": [
      "Minimal CPU footprint to avoid triggering user suspicion in Task Manager",
      "Delaying clipboard interception routines until system uptime exceeds 15 minutes",
      "String encryption masking attacker wallet addresses in the binary body"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "394a5b6c7d8e9f0123456789abcdef0123456789",
      "4a5b6c7d8e9f0123456789abcdef0123456789ab"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ClipBankerSvc",
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ClipMonitor"
    ],
    "file_paths": [
      "%AppData%\\ClipBanker\\clipbanker.exe",
      "%Temp%\\clip_log.dat",
      "%ProgramData%\\ClipBanker\\wallets.cfg"
    ]
  },
  "defensive_measures": [
    "Use hardware wallets that require physical visual verification of the recipient address on a separate secure screen",
    "Deploy endpoint security that monitors unauthorized applications registering clipboard listeners via AddClipboardFormatListener",
    "Never download cryptocurrency tools, trading bots, or software cracks from unverified third-party sources"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan-Banker:Win32/ClipBanker",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan-Banker:Win32/ClipBanker"
    },
    {
      "name": "Kaspersky Securelist - Trojan-Banker.Win32.ClipBanker Analysis",
      "url": "https://securelist.com"
    },
    {
      "name": "Malwarebytes Threat Intelligence - Trojan.ClipBanker",
      "url": "https://www.malwarebytes.com"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Trojan-Banker.Win32.ClipBanker.A",
      "Trojan-Banker.Win32.ClipBanker.gen",
      "CryptoClipBanker"
    ]
  },
  "motivation": "Direct Financial Theft & Cryptocurrency Expropriation",
  "sample_hashes": []
}