Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
Cryptocurrency is being used every day to facilitate a variety of transactions. It’s unlike the usual banking systems, having its own unique strengths and weaknesses. Attackers have made specialized malware to redirect normal transactions to wallets they control in order to steal money, referred to as “Clipbankers”. Due to the nature of cryptocurrency, these transactions are irreversible. ReversingLabs investigated two malware families of this nature, digging into how they work. This blog discusses the general trend of Clipbanker malware, why they can be successful, what specific samples look like, and how to avoid them.
There is a type of malware designed with one main goal in mind, to replace copied cryptowallet addresses with ones that are controlled by the attacker. For the sake of consistency, this blog will use the term “Clipbanker” as a way to refer to the general group of malware with this specific behavior. More sophisticated variations match the replacement address to a similar attack controlled one, lowering the chance of detection. While Clipbankers are most known for their ability to replace intended wallet addresses with attacker-controlled addresses, they also often come with other malicious features. They can generally monitor and exfiltrate data in the clipboard, or be leveraged for other infostealing purposes.
Three things combine to make this type of malware effective. First, is the innate trust in the clipboard. Most people regularly use the copy and paste function on their devices. It’s automatic and second nature, and usually they assume that unless something is glaringly wrong, that what they had intended to copy is what actually ends up pasted. In a lot of cases, it’s pretty immediately recognizable when something doesn’t copy and paste correctly, since people can confirm their copy-paste for consistency with a quick glance. This is where the second element that plays in the attackers favor sets in. Crypto wallet addresses are long strings of random characters, which are much harder to scan for discrepancies. When copy-pasting a physical address, an incorrect street name is glaringly obvious. However, a long string of numbers is a long string of numbers, they all look the same. Some attackers program their malware to provide a malicious address that matches the first or last numbers of the original address, so cursory checks of the most noticeable numbers can be fooled. Another note here is that even if the user noticed the discrepancy, they may not realize the issue is due to malware, and may assign it to more benign reasoning. While they may catch the issue and figure out how to correct it, they're still vulnerable.
The cognitive biases in the user are a boon to the attacker, and there is a third factor in the attacker's favor. Crypto transactions are irreversible. Crypto differs from traditional banking by being on the blockchain. The blockchain is a cryptographic solution that involves many machines maintaining ledgers that store transaction records, storing them into blocks. Since blocks contain the hash of the previous block, tampering with these records is not possible. “Imutable” is the word used to describe this unchanging nature. In addition to the structure of the blockchain, crypto is decentralized. There is no authority to complain to get transactions reversed. There is little recourse for those who misplace their payments. There are some legitimate uses to this system, such as mitigating chargeback scams or similar malpractice. Unfortunately, it also makes cryptocurrency appealing to hackers.
With these factors in mind, it’s quite obvious why attackers are gravitating towards this as a way to a payday. It’s easy to catch someone vulnerable off guard and route their legitimate activity to an illegitimate source. Once it’s done, it’s done, and the attacker can make off with their prize. That’s why attackers build speciality malware to replace addresses. There are multiple things in their favor if they can redirect these payments without being detected, so they make subtle and evasive malware to accomplish this goal.
Recently, ReversingLabs has been looking into two malware families of this type: AnimateClipper and Efimer. AnimateClipper, also called ZigClipper, is the newer of the two. It is classified differently depending on the source, but predominately the AnimateClipper title is used. Efimer is an older family, notable for the specific ways it matches the intended recipient address with the attacker controlled ones. Efimer matches leading or trailing digits, depending on the address type. Both became inactive soon after RL completed this research, but they still serve as valuable examples of ClipBanker malware.
Figure 1: Cumulative graph of AnimateClipper (yellow) and Efimer (orange) first seen counts per day from July 14 to October 12, 2026 (Generated by Spectra Intelligence MCP).
As shown by the graph, most of the activity for these families occurred throughout July. Both plateau for August, marking lessened activity. AnimateClipper flatlines aside from activity at the end of August. Efimer is slightly more active during August, and jumps up suddenly between August 17th and 21st, leveling out between the 22nd and the 20th, before plateauing again up until a small amount of recent activity.
AnimateClipper is a relatively new malware, being first picked up in January of 2026. July 2026 is when the AnimateClipper name started to see more use. The alternate alias, ZigClipper, relates mainly to the use of the Zig compiler for payloads or droppers. AnimateClipper is the name coined by threat intelligence groups. Not much has been reported about it. Typical AnimateClipper distribution involved fake software installs and ClickFix. Sometimes AnimateClipper is delivered alongside other malware families, mainly infostealers.
Once AnimateClipper is on a machine, it monitors the clipboard for patterns indicative of crypto wallet addresses. Once it detects a potential address, it swaps it for an attacker controlled one within the same ecosystem. Address formats vary across different types of cryptocurrency networks, so the malware is designed to figure out which cryptocurrency is being used so it can appropriately reroute payment.
Instead of just seeking out patterns, Efimer specializes in matching digits to the addresses it replaces. Depending on the type of address, it tries to match the first or last one to three digits. For example, it tries to match the first three digits of Ethereum addresses. It can recognize Ethereum addressing through the 0x leading character and the total length being between 40 and 44. Similar mechanisms exist for Bitcoin and Monero addresses. On top of address replacement, Efimer also exfiltrates the clipboard data and screenshots.
Efimer is also designed to be evasive and difficult to analyze. It shuts down when it detects analysis environments and tools. It utilizes Pyarmor protection on its code, and the payload is XOR encrypted. Javascript present is obfuscated as well. It connects to its C2 through TOR and [.]onion domains, and only does so on a specific interval to minimize traffic on the network. In addition to sending the attacker information, it can also receive further commands of what to do on the infected device. An interesting quirk is that builds of Efimer are generated on an hourly basis, leading to 24 new samples per day.
Figure 2: Page showing hourly build generation. Times are all around 53 minutes on the hour.
In 2026, a related family, CryptoBandit, emerged. Due to overlap in the code, specifically the digit matching behavior, it is likely CryptoBandit is an evolution of Efimer. CryptoBandit targets the exact same wallets and address patterns.
Figure 3: CryptoBandit’s address replacement feature, image from Microsoft.
Aside from wallet and address patterns, other similarities include C2, file structure, and anti analysis features.
Efimer has been distributed by phishing emails, fake torrent sites, fake software, and fake error ClickFix.
These Clippers are frequently delivered by social engineering, like ClickFix or fake software. Due diligence is one of the key factors to prevent the installation of ClipBankers. Be wary of websites asking to verify identity using Powershell, as that is not a legitimate verification avenue. Using tools to check files for malicious indicators is recommended before running.
Generally speaking, it is also important to be diligent when using cryptocurrency services. When transferring, carefully verify the address before sending. Small mistakes can have big consequences, regardless of the infection status of the machine being used. Double check the numbers before hitting send. If they aren’t lining up, it’s a good time to investigate why. Was it a misclick? A typo? Or is there something in your environment that shouldn’t be there?
While the use case of Clipbankers is very specific, they are lucrative when they are successful. Attackers get money sent directly to their accounts, with little recourse possible for the victim. The malware works because of user trust in their machine, the difficulty in memorizing long strings of numbers, and the irreversible nature of cryptocurrency transactions. Two specific families were AnimateClipper and Efimer, although they are now inactive. AnimateClipper is often distributed with other malware, like infostealers, and uses pattern matching to identify one of many wallet types in order to replace the original address with an attacker controlled one. Efimer is able to both recognize specific wallets, but also match them to similar addresses the attacker controls, decreasing the likelihood of the victim noticing a mismatch. In order to stay safe from this threat, be critical of the sources of software before downloading, and be familiar with typical ClickFix and phishing techniques. This diligence can help avoid many types of malware, including ClipBankers. When dealing with cryptocurrency, be sure to double check transaction information before sending. If your clipboard is pasting the wrong wallet address, check your machine for ClipBankers.
Collected end of August 2026
hxxps://tuasesoriadigital[.]es/default.dat
hxxp://tuasesoriadigital[.]es/default.dat
hxxps://hasansunnah[.]xyz/composer.dat
hxxp://hasansunnah[.]xyz/composer.dat
hxxps://voedseltuinijplein[.]nl/composer.dat
hxxp://voedseltuinijplein[.]nl/composer.dat
hxxps://webenvysolutions[.]com/composer.php
hxxp://167.233.30[.]202/files/swfe60.exe
hxxp://167.233.30[.]202/files/9je7p2.exe
hxxp://167.233.30[.]202/files/xgc6jp.exe
hxxp://167.233.30[.]202/files/wjpr1q.exe
default.dat.exe
default.dat
visioncraft_ai.exe
composer.dat
IIPaint Software
VisionCraft Labs
Composer Dependency Manager for PHP
hxxp[://]gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad[.]onion/route.php
hxxp[://]hek5ensy7wqqls2cafflihs7sdqr4dwxux47vp3k7pgffeasxsfeeyid[.]onion/recvf.php
hxxp[://]hek5ensy7wqqls2cafflihs7sdqr4dwxux47vp3k7pgffeasxsfeeyid[.]onion/route.php
hxxp[://]swjxev2rvxfivi2wvkxre5vaxkjeepxzxva4u4ydm2qbkbakh6wnyead[.]onion/core/repla.php
Due to hourly build generation, there are hundreds of samples. These were examples from a 24 hour period
e46f514e456c5e27f60854e4156234e6ae8c4dd5892ddb4d2d557de02fc2cd15
bb796bb63f6985e75dbb6c1f8eb8640dee859f989f09a4a2fd9102d33918139b
3cc7dab11f0f333fad56e428efaa638ccbf7af16eb4dfc8dab2621732fb22d92
a77b9a651bd09e64215bdfc65d99fe93bff5dfa8a50748f02bf5d9b699399736
31876a3a26a0f92a001dcae2b84174bb9f47af9208f7a92b6e160b1931899b01
d91e69f6cfc7d484a6a67de2e65712e995590af17a419b0b0c1ea22de3d2f81f
47b63f2e99323a4494c3a4ebd8bba9f8a0466356d10ed4df477e046101a21c2b
2978fc4af143e194885eb6df3e92a885fd7f820dacdbffd0478be972e449523f
55f0b60af40ee8affb3184145d88b70383837fea57d2de8f52b64665d5314e6e
c7004fc843cc835a5c72630c78d1a11c052245352906e19214a439f8393a55cc
2febd77a459f7f10ecf3bf36fa42689f765a333990ced7f04ab898e0595edbb2
deb1cf717b00ddab4e32f30c29a65616dca2b7251aeb1f7fb837893d3ffe0176
892e3dee69fbd32403412137c34b784707f1e7062938501ee34dca9f8695c61a
5fa3e214842722f8dbc56499a74b3794701fd00a7c38396f9bd22c382ad73816
b6f4e866faa39925863efbd15904a5fc85a5c08b555965211cf95edc26fe42a1
d97ea10d1dbfe2a69e0d2387e8985635b20628495918abd54c4b052c0acf05b1
fee9293adc75678d15c372c03604d9622cb65259821a54ef912248c53f9d9192
40dc7440564975985476e30a20135a9de794c920b63e84aa9447af9d06efc678
bc4bfc479321f0ec2785e1488ed5421ab3f540fe55f4943748e49b1e6030fdeb
24aa10a7b03a9ae4dcfda6eab4a06e634cd7012f77fb05d95a444f7a970aec05
e77c1d3fd059fe8248e81fdfcbdc1f72c99bd208e4951203e43e16f803dabb1d
542ff833aa11374be9b2f2278eb808a4b17d754a72715bf6af0f13c1c68a9d3a
5a07da677d17aa1de19d6450bc1c183305ad85d917e20b2518a0a9d4d2c16ce8
033dd215975f5dcd61ca5f7685d8618154b674d0b9e3262549140dc66e4701d5
1682401b0fad7aa78a23e0b34b56257cc6add40c0d0943d2076833a29feb8e54
1a7127495413e5e950e7794a05ff3cf0f6d9d5c619d5b38155d7a3f653430942
2635bacc8347ce37b9e0fdfd8d5c496eb9e41ff4c32b7fe2608953d1cb99bcdf
2bac84d2f06457096fe38a402d1b0562131a6c7a651c04720fe014d88b4fe3c7
4ee3dc0b5f5016cd393261b2b6eb71df7b26cf1de4c16ffbdb13975566359678
5946108772430f963d35e9b2611471dc88fd67708fd3a6aa6876a7a8db8400bf
63436915dc43fd23c41152ae7e113b4b1ecc34bfd32d80a4f00454e9c8a741b5
66ebc94e42637cb4ad8975f19791821344a86ce2eb0fcc4b9305554c986a8e15
6a21b696bcf9a0b1a4f03f51df19870591a52d6182270cdc453b4b46543097b7
7c05584e2c3e8d53f8a171d9268054894799615fac8aacb8193948f0cbbdd4d9
82d3435d4f190e8d4d5cf618010b25c37653e12cd4499d18b6e52bdf5a7459dc
83f1d9e59c02b4828e64b94e9f618c5494341a0f30bf52552ef75c250f3847ff
8dfad18030c70676a14dd62e41412d324c896e6226e9ceedb2fb04f33c27a9a6
98a58499d8228c45f55bc5a391d1ae29c9e30fd2ecadacfff4a6c8df4064bd32
a177b1e813ebde8a442a52d90cb31c860d809b259d50c9608ec1fc2c076bb343
a2b0d4fc578e3fc73e5026fb77e2ced8049b8bb770682e3fcf5be9ff23a619b6
a654d127b9689f2da9d28fc3756142877f7e15264652801ae077c4887dd126fd
aa3b4c4cf1d2a059c233f10bc4827298522e0bc1a66b192d4410aca6131d91ce
b5a1c345cfec0b35dbf81803523cdc09edeb061f6d522f43da70107d4fbb94f1
c3180fb60f54da6440b3fa2d2569e5966c92b0fd3c451b7be0bba0e9dd5a967c
dddfbdf29601425688d41711ad3748cda62b111aa03622c8174b3c09b7d4f661
f5b419e2adc3a2e802f13fd3c089ae183e9f8216b58be8d366721600fc314209
8f96d7712f17e0bc0153be56fc33ad3fed4948794a9768bc9e6598e9ed27395f
Javascript Payloads
5250927806bc7087963d16298a341c301fa0f29f94cd6eb40518827ede3b04d4
c49dc64559ca84df2716113592b84ada7704e783a3e31b3ab42b531cc835e996
2226f06646126f16779442632a472803e14e0d5bc5a7a22f172b8f58d3113593
Collected September 2026
030edb0266cbb6f7b998461096304bcf345a44ceb67ac16ae88a7839a539f271
12f14940567788a509fbb700948eb6f9eec1f311aa456ba6f6dba661c9dcc0da
17b2fa8686141b4f5d2e7bef36e992caa4ca8763827976d3fa8a45dc9a6eb4de
1943d401836d4f87ce42ab82e40d695a9c507bdb116714bdf7315d4a58af048c
3d3b91df2fdac41a8a455397e1037daade8c399286b2e1ae067eb1941c1a3113
3de86edbdec211a07a456e90f8962bf2e9e68fc8d73580b18d03edc43d32a64d
449891824f9dff1e6160ef818a0f0045d64d7ef8551dd5f19f421702a4813a42
50f10f19c0c10cdbcd11d9d8498c9ab4805f500cc65d6bb2404235090eb595db
53bdd0bfed83d62fe52cbb1b917d8f9b80a67ab0ea98fbeb9ce5c863989729eb
55563d2f91b11bb887231475f0216cb84f6e62fda0cd5adbfbd813ca27b1ed1d
57ea5692ac1f837bf97cb0c1c0fd4a06c37bb8d7a64dab3a544869b1363ab822
72f807c8536ef841f4854d955e7f97120b13faad909de5527e6c2e8be563eb97
804778b6ef86bb18eb82b3d639d8caaf6de15509f863ed5dd6e4a1bb8bbf122e
80abc3f7826a2bcef4b1cec2ad4308fe1c154f704bb86af97902370be6872053
8b34daf226e7e34393687aeed646b1b813a04d5b8127a7259704892ad50615a3
a26253ecc8e5d3e30c42500dddf9fa5fd8be493667059093fd79fac04b312a4d
a6a7312ffdb4baf3713dc3c191be57e0189c814590eebd72e08f5cae632fffc1
aa0fb52cbe993793cef2cc3c80c5cc0def5dc667209cce137fe7e052162db805
b6f4849d1150b8e44a005bbae7478730703c544b2ca0d82d4df0d13131044bee
b947bae3c1e0f3abe7e1408d0a18e38955e7f5357995b0f96c5e221493971268
bb480e9c74827a1add5bcd67a7a4cdd685ee448df5558aa6ef600cd53c0b0b45
c74591b3eed1fe493d3d984de84ccd82f0a481020408aca596924de78a4a8bec
d6aa943e7b696141090fe55c9f5f424e97abc8b52a6b469dff0448e1cf5ad54e
ea5b7f5b1b8c23e4bf84117050095b757d86496191f87428e5e4fde2d1ab778c
ed3a66132044ad25b5e7f13b6fda5ccec35df0e27e3138fd294c1827164b6ede
f5aeda5f14f021fc3f85fc1d4b889252277dbf3d95937e2fe5886495ba6059cc
celebration-internet[.]cc
lb.propertyfind[.]cc
static.quorashift[.]cc
kffd3.vexlatech[.]cc
kkc.vogueatelier[.]cc
hxxps://kupunasvolpiano[.]com/g/static/s/cinzel/v23/Taskforce.exe
hxxp://91.92.47[.]8/quis.exe
hxxps://91.92.47[.]8/quis.exe
hxxps://hindustanagency[.]com/666.exe
hxxps://muaklekcoop[.]com/js/quis.exe
hxxps://thepullmanfolkestone[.]com/ppisondeers.exe
hxxps://peniclean[.]com/nvd_driver_dll.exe
hxxps://microlsireqjn[.]com/nvd_driver_dll.exe
hxxps://peowlakjew[.]com/clean_driver_dll.exe
hxxp://64.89.161[.]122/SW.exe
hxxps://cim-kolea[.]com/3.exe
hxxps://wantsellonline[.]com/1.exe
First reported by ReversingLabs in February, the malware has moved to Terraform providers and Go modules. Here’s what you need to know.
ReversingLabs expanded the published hashes into a staging server, five stagers, two lure files and the domain-to-server links.
New btree malware bypasses the install script, negating the popular repo's measure barely two months after adoption.
