Clipminer Botnet Makes Operators at Least $1.7 Million

Keypoints

• Clipminer is a crypto-mining Trojan (Trojan.Clipminer) that also hijacks clipboard content to redirect cryptocurrency transactions.
• It appears to be spread through Trojanized downloads of cracked or pirated software and arrives as a self-extracting WinRAR archive dropping a packed downloader DLL with a CPL extension.
• The malware connects to the Tor network to fetch its components and to communicate with its operators, including sending machine data to an Onion Service.
• Clipboard hijacking involves replacing wallet addresses in the clipboard with attacker-controlled addresses, with thousands of wallet addresses embedded in the malware.
• Operating funds include Bitcoin and Ethereum, with evidence pointing to cryptocurrency tumblers used to obscure the trail, contributing to an estimated $1.7 million in gains from clipboard theft alone.
• Persistence is achieved via RunOnceEx registry keys and scheduled tasks, and the loader drops into carefully named directories to avoid detection.
• The malware harvests system information, captures screenshots, and uses XMRig (or other miners) to mine when the machine is idle or underutilized, potentially leveraging GPUs as needed.