# Clipbanker malware AnimateClipper (ZigClipper) and Efimer redirect crypto payments by swapping clipboard wallet addresses

> ReversingLabs describes clipbanker malware families AnimateClipper (ZigClipper) and Efimer that replace copied cryptocurrency wallet addresses with attacker-controlled ones. Efimer matches the first or last 1-3 digits of the victim address to make swaps harder to notice; delivery is via fake software installers, ClickFix, phishing emails and fake torrent sites.

- **Published:** 2026-10-29T19:39:35Z
- **Last reviewed:** 2026-10-29T19:39:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4766
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4766.png
- **ID:** TL-2026-4766
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

ReversingLabs' Threat Researcher's Notebook documents two Windows clipbanker (clipper) families monitored through 12 October 2026. Clipbankers watch the clipboard for strings matching cryptocurrency wallet address formats and silently substitute an attacker-controlled address so that a victim's paste sends funds to the attacker.

AnimateClipper (also tracked as ZigClipper) is a relatively new family first detected in January 2026, with widespread activity in July 2026. Its droppers and payloads are built with the Zig compiler. It recognizes multiple wallet address patterns and swaps in an attacker wallet from the same cryptocurrency ecosystem. It is frequently distributed alongside infostealers; public sample-sharing tags associate it with ClearFake and ACRStealer. ReversingLabs published five AnimateClipper C2 hostnames, eleven distribution URLs and 25 SHA256 hashes collected in September 2026. Payload filenames include Taskforce.exe, quis.exe, 666.exe, nvd_driver_dll.exe, clean_driver_dll.exe, SW.exe, 3.exe and 1.exe.

Efimer is an older family (first reported by Kaspersky in October 2024) notable for digit-matching address replacement: depending on the cryptocurrency, the replacement address is chosen so that the first or last 1-3 characters match the address the victim copied, which makes the swap harder to spot. It recognizes Ethereum (0x prefix), Bitcoin and Monero addresses (Kaspersky additionally reports Tron and Solana and theft of seed phrases). It also exfiltrates clipboard data and screenshots, communicates with C2 over Tor .onion services at scheduled intervals, accepts remote commands, and uses Pyarmor protection, XOR-encrypted payloads, obfuscated JavaScript and scheduled tasks. ReversingLabs observed a 24-hour sample set in August 2026 (builds generated roughly hourly, 24 samples per day) consisting of PyInstaller executables, Pyarmor DLLs, a scheduled-task XML and JavaScript payloads, with an Efimer surge between 17 and 21 August 2026. The report notes CryptoBandit (emerged 2026) as a possible Efimer evolution with similar digit-matching behavior.

Delivery vectors named in the report are fake software installations (imitating IIPaint Software, VisionCraft Labs and the Composer dependency manager for PHP), ClickFix prompts (including fake PowerShell identity verification requests), phishing emails and fake torrent sites. Detection activity peaked in July 2026 and decreased in August; the report states both families became inactive after the research period. No CVE, CVSS score or actor attribution is stated in the source; severity is analyst-assigned.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1204.004 Malicious Copy and Paste
- T1059.007 JavaScript
- T1053.005 Scheduled Task
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1090.003 Multi-hop Proxy
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**AnimateClipper/Efimer Clipbanker Payload Launch or ClickFix PowerShell Cradle — Exploitation Phase** (`TL-2026-4766-SPL-001`)

Behaviour-first detection of the execution stage of the AnimateClipper (ZigClipper) and Efimer clipbanker campaigns: known payload filenames (Taskforce.exe, quis.exe, nvd_driver_dll.exe, clean_driver_dll.exe, visioncraft_ai.exe), short-named payloads (SW.exe, 3.exe, 1.exe, 666.exe) in user-writable folders, and ClickFix PowerShell download cradles spawned from explorer.exe after a fake identity-verification prompt. Maps to T1204.002, T1204.004, T1036, T1105.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1204.004, T1036, T1105
- **Data sources:** sysmon, windows_process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval img=lower(Image), cmd=lower(CommandLine), parent=lower(ParentImage)
| eval named_payload=if(match(img,"\\\\(taskforce|quis|nvd_driver_dll|clean_driver_dll|visioncraft_ai)\.exe$"),1,0)
| eval short_payload=if(match(img,"\\\\(appdata|downloads|temp|desktop|public)\\\\([^\\\\]+\\\\)*(sw|3|1|666)\.exe$"),1,0)
| eval clickfix=if(match(parent,"\\\\explorer\.exe$") AND match(img,"\\\\(powershell|pwsh)\.exe$") AND match(cmd,"(iex|invoke-expression|invoke-webrequest|iwr|downloadstring|frombase64string)") AND match(cmd,"(-w(indowstyle)?\s+hidden|-nop|-ep\s+bypass|-enc)"),1,0)
| where named_payload=1 OR short_payload=1 OR clickfix=1
| eval detection_reason=case(named_payload=1,"known_clipper_payload_filename",short_payload=1,"short_name_payload_in_user_path",clickfix=1,"clickfix_powershell_download_cradle")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines by host User Image ParentImage detection_reason
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let lookback = 24h;
let payload_names = dynamic(["taskforce.exe", "quis.exe", "nvd_driver_dll.exe", "clean_driver_dll.exe", "visioncraft_ai.exe"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| extend Cmd = tolower(ProcessCommandLine)
| extend NamedPayload = FileName in~ (payload_names)
| extend ShortPayload = FolderPath matches regex @"(?i)\\(AppData|Downloads|Temp|Desktop|Public)\\([^\\]+\\)*(sw|3|1|666)\.exe$"
| extend ClickFix = tolower(InitiatingProcessFileName) == "explorer.exe" and FileName in~ ("powershell.exe", "pwsh.exe") and Cmd matches regex @"(iex|invoke-expression|invoke-webrequest|iwr|downloadstring|frombase64string)" and Cmd matches regex @"(-w(indowstyle)?\s+hidden|-nop|-ep\s+bypass|-enc)"
| where NamedPayload or ShortPayload or ClickFix
| extend DetectionReason = case(NamedPayload, "known_clipper_payload_filename", ShortPayload, "short_name_payload_in_user_path", "clickfix_powershell_download_cradle")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionReason
```

### Sigma

```yaml
title: Clipbanker ClickFix PowerShell Cradle or AnimateClipper/Efimer Payload Launch
id: 7c1e9a52-3f4b-4d86-9a1e-5b2d8c6f4a01
status: experimental
description: Detects execution of known AnimateClipper/ZigClipper and Efimer payload filenames, short-named payloads (SW.exe, 3.exe, 1.exe, 666.exe) run from user-writable folders, and ClickFix-style PowerShell download cradles spawned from explorer.exe (Run dialog).
references:
    - https://www.reversinglabs.com/blog/threat-researchers-notebook-how-attackers-redirect-crypto-payments
    - https://securelist.com/efimer-trojan/117148/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-29
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1204.004
    - attack.defense-evasion
    - attack.t1036
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|endswith:
            - '\taskforce.exe'
            - '\quis.exe'
            - '\nvd_driver_dll.exe'
            - '\clean_driver_dll.exe'
            - '\visioncraft_ai.exe'
    selection_short:
        Image|re: '(?i)\\(appdata|downloads|temp|desktop|public)\\([^\\]+\\)*(sw|3|1|666)\.exe$'
    selection_clickfix_parent:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'iex'
            - 'invoke-expression'
            - 'invoke-webrequest'
            - 'iwr'
            - 'downloadstring'
            - 'frombase64string'
    selection_clickfix_flags:
        CommandLine|contains:
            - '-w hidden'
            - '-windowstyle hidden'
            - '-nop'
            - '-ep bypass'
            - '-enc'
    condition: selection_name or selection_short or (selection_clickfix_parent and selection_clickfix_flags)
falsepositives:
    - Admin scripts launched interactively from the Run dialog with download cradles
    - Legitimate software that ships a file named 1.exe or 3.exe in a user profile folder
level: high

```

**Known false positives:**

- Administrators who paste PowerShell download cradles into the Run dialog for legitimate deployment
- Third-party software that legitimately ships 1.exe, 3.exe or SW.exe inside a user profile folder

**Tuning notes:** Short names (sw/3/1/666) are matched only under Downloads/AppData/Temp/Desktop/Public; exclude your software-deployment tooling by Image path or ParentImage. Tighten the ClickFix leg by requiring an external URL in CommandLine. Sysmon EventCode=1 must be collected into index=sysmon; adjust index/sourcetype to local naming.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Efimer WSF/JS Installer via Script Host and Clipbanker IOC Hash Match — Exploitation Phase (locked: unlock with TL Creds)
- Efimer Pyarmor Runtime Load from PyInstaller/User-Writable Path — Post-Exploitation (locked: unlock with TL Creds)
- Clipbanker Payload Staging Download from Known Infrastructure — C2 Phase (locked: unlock with TL Creds)
- AnimateClipper/Efimer Payload File Creation — Exploitation Phase (locked: unlock with TL Creds)
- Scheduled Task Persistence for User-Path Payload or Script Host (Efimer) — Post-Exploitation (locked: unlock with TL Creds)
- DNS Resolution of Clipbanker C2 Domains and Tor Onion Names — C2 Phase (locked: unlock with TL Creds)
- Clipbanker Clipboard Rewrite by Process in User-Writable Path — Post-Exploitation (locked: unlock with TL Creds)
- Clipbanker C2 / Staging IP and Local Tor Proxy Connections — C2 Phase (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `167.233.30[.]202`
- Domain: `gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad[.]onion`
- File hash: `e46f514e456c5e27f60854e4156234e6ae8c4dd5892ddb4d2d557de02fc2cd15`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Threat Researcher's Notebook: How Attackers Redirect Crypto Payments](https://www.reversinglabs.com/blog/threat-researchers-notebook-how-attackers-redirect-crypto-payments)
- [Efimer Trojan (Securelist, Kaspersky)](https://securelist.com/efimer-trojan/117148/)
- [Efimer Trojan using hacked websites to steal cryptocurrency (Kaspersky blog)](https://www.kaspersky.com/blog/efimer-trojan-steals-crypto/54066/)
- [Kaspersky Uncovers Efimer Trojan Spreading Through Phishing Emails (SecurityMEA)](https://securitymea.com/2025/08/12/kaspersky-uncovers-efimer-trojan-spreading-through-phishing-emails/)
- [Efimer steals cryptocurrency, hacks WordPress, and sends spam (Hackmag)](https://hackmag.com/news/efimer)
- [Efimer cryptocurrency trojan spread via email, WordPress sites (SC Media)](https://www.scworld.com/news/efimer-cryptocurrency-trojan-spread-via-email-wordpress-sites)
- [Efimer Malware Steals Cryptocurrency and Hacks WordPress via Torrents and Phishing (ThaiCERT)](https://www.thaicert.or.th/en/2025/08/15/9125/)
- [MalwareBazaar: AnimateClipper / ZigClipper samples (abuse.ch)](https://bazaar.abuse.ch/sample/350e3bddcd39098123be338cfcd12ef78a0d6cfabc48a17c6dacf31397880b3c/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4766