AnimateClipper, ZigClipper & CryptoBandit Clipbanker Campaign: OTX Pulse Analysis — Clipboard Hijacking Detection Pack

---
title: Clipbanker Clipboard Monitoring via Windows Clipboard API
id: 3f7a2b1c-clipbank-0001-clipboard-monitor-suspicious
description: Detects suspicious processes registering clipboard listeners or polling clipboard contents, behavior consistent with AnimateClipper, ZigClipper, Efimer and CryptoBandit clipbanker families.
status: experimental
author: Security Arsenal Threat Intel
date: 2026/11/02
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_cmd:
    CommandLine|contains:
      - 'AddClipboardFormatListener'
      - 'Get-Clipboard'
      - 'System.Windows.Forms.Clipboard'
      - 'SetClipboardViewer'
      - 'OpenClipboard'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate clipboard managers and password managers
  - Automation/RPA tooling
level: high
tags:
  - attack.collection
  - attack.t1115
---
title: ClickFix-Style User-Executed PowerShell Followed by Payload Download
id: 3f7a2b1c-clipbank-0002-clickfix-download-cradle
description: Detects PowerShell download cradles fetching executables staged as driver components, matching CryptoBandit delivery of nvd_driver_dll.exe via ClickFix lures.
status: experimental
author: Security Arsenal Threat Intel
date: 2026/11/02
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cradle:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'Net.WebClient'
      - 'DownloadFile'
      - 'curl.exe'
      - 'Start-BitsTransfer'
  selection_payload:
    CommandLine|contains:
      - 'nvd_driver_dll.exe'
      - 'default.dat'
      - '.exe'
  condition: selection_ps and selection_cradle and selection_payload
falsepositives:
  - Software deployment scripts (SCCM, Intune) — baseline and exclude known admin sources
level: critical
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1105
  - attack.t1204.002
---
title: Clipbanker Persistence via Run Key Masquerading as Driver Update
id: 3f7a2b1c-clipbank-0003-runkey-driver-masquerade
description: Detects registry Run-key persistence using driver-themed value names, consistent with AnimateClipper and ZigClipper persistence mechanisms.
status: experimental
author: Security Arsenal Threat Intel
date: 2026/11/02
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run\'
  selection_name:
    Details|contains:
      - 'driver'
      - 'nvidia'
      - 'nvd_'
      - 'update_helper'
  filter_legit:
    Image|endswith:
      - '\NvContainer.exe'
      - '\nvidia-smi.exe'
  condition: selection_key and selection_name and not filter_legit
falsepositives:
  - Genuine OEM driver updaters — validate signer and file path
level: high
tags:
  - attack.persistence
  - attack.t1060
  - attack.t1547.001

// Security Arsenal — Clipbanker (AnimateClipper/ZigClipper/Efimer/CryptoBandit) Hunt
// Hunts network IoCs, ClickFix-style download cradles, and clipboard-access behavior
let ClipIOC = dynamic(["wantsellonline.com","muaklekcoop.com","tuasesoriadigital.es","microlsireqjn.com","peniclean.com"]);
let lookback = 90d;
// Part 1: Network connections to staging/C2 infrastructure
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any (ClipIOC)
   or RemoteUrl endswith "gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad.onion"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
// Part 2: ClickFix-style PowerShell download cradles fetching staged payloads
let CradleHits = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any ("Invoke-WebRequest","Net.WebClient","DownloadFile","Start-BitsTransfer","iwr ","curl ")
| where ProcessCommandLine has_any ("nvd_driver_dll.exe","default.dat") or ProcessCommandLine has_any (ClipIOC)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
// Part 3: Clipboard polling from non-interactive or script interpreters (T1115)
let ClipboardHits = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where ProcessCommandLine has_any ("Get-Clipboard","AddClipboardFormatListener","System.Windows.Forms.Clipboard")
| where FileName !in~ ("explorer.exe","ditto.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
union NetHits, CradleHits, ClipboardHits
| sort by TimeGenerated desc

# Security Arsenal - Clipbanker IOC & Artifact Hunt
# Checks registry Run keys, staged payload files, scheduled tasks, and live network connections
# Run elevated on suspect endpoints or deploy via EDR live-response / GPO startup script

$Report = @()

# 1. Hunt for masqueraded Run-key persistence (AnimateClipper / ZigClipper pattern)
$runPaths = @(
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($path in $runPaths) {
  if (Test-Path $path) {
    Get-ItemProperty $path | ForEach-Object {
      $_.PSObject.Properties | Where-Object {
        $_.Name -notmatch '^PS' -and ($_.Name -match 'driver|nvidia|nvd_|update_helper' -or $_.Value -match 'nvd_driver_dll|default\.dat|AppData|Temp')
      } | ForEach-Object {
        $Report += [PSCustomObject]@{Check='RunKeyPersistence'; Artifact="$path -> $($_.Name) = $($_.Value)"; Severity='HIGH'}
      }
    }
  }
}

# 2. Hunt for staged payload files (CryptoBandit nvd_driver_dll.exe / Efimer default.dat)
$searchRoots = @("$env:TEMP","$env:LOCALAPPDATA","$env:APPDATA","$env:ProgramData","C:\Users\Public")
foreach ($root in $searchRoots) {
  Get-ChildItem -Path $root -Recurse -Include 'nvd_driver_dll.exe','default.dat' -ErrorAction SilentlyContinue | ForEach-Object {
    $Report += [PSCustomObject]@{Check='StagedPayloadFile'; Artifact=$_.FullName; Severity='CRITICAL'}
  }
}

# 3. Hunt scheduled tasks with driver-themed masquerade names
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
  $_.TaskName -match 'driver|nvidia|nvd_|update_helper' -and
  ($_.Actions.Execute -notmatch 'NVIDIA|Microsoft|Intel|AMD')
} | ForEach-Object {
  $Report += [PSCustomObject]@{Check='SuspiciousScheduledTask'; Artifact="$($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)"; Severity='HIGH'}
}

# 4. Check live/recent network connections to campaign infrastructure
$badHosts = @('wantsellonline.com','muaklekcoop.com','tuasesoriadigital.es','microlsireqjn.com','peniclean.com')
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
  $conn = $_
  try {
    $rdns = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
    foreach ($bad in $badHosts) {
      if ($rdns -match [regex]::Escape($bad)) {
        $proc = (Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue).ProcessName
        $Report += [PSCustomObject]@{Check='LiveC2Connection'; Artifact="$proc (PID $($conn.OwningProcess)) -> $rdns ($($conn.RemoteAddress):$($conn.RemotePort))"; Severity='CRITICAL'}
      }
    }
  } catch {}
}

# 5. Flag Tor client presence (onion C2 indicator)
$searchRoots | ForEach-Object {
  Get-ChildItem -Path $_ -Recurse -Include 'tor.exe' -ErrorAction SilentlyContinue | ForEach-Object {
    $Report += [PSCustomObject]@{Check='TorClientPresent'; Artifact=$_.FullName; Severity='MEDIUM'}
  }
}

if ($Report.Count -gt 0) {
  $Report | Sort-Object Severity | Format-Table -AutoSize
  $Report | Export-Csv -Path "$env:TEMP\clipbanker_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
  Write-Output '[+] No clipbanker artifacts detected on this host.'
}