SYMBOLCOMMON_NAMEaka. SYNONYMS
win.clipbanker (Back to overview)

ClipBanker

The ClipBanker Trojan is known as an information stealer and spy trojan, it aims to steal and record any type of sensitive information from the infected environment such as browser history, cookies, Outlook data, Skype, Telegram, or cryptocurrency wallet account addresses. The main goal of this threat is to steal confidential information.
The ClipBanker uses PowerShell commands for executing malicious activities. The thing that made the ClipBanker unique is its ability to record various banking actions of the user and manipulate them for its own benefit. The distribution method of the ClipBanker is through phishing emails or through social media posts that lure users to download malicious content.

References
2022-06-28 ⋅ AhnLab ⋅ ASEC
@online{asec:20220628:new:df3f9bf, author = {ASEC}, title = {{New Info-stealer Disguised as Crack Being Distributed}}, date = {2022-06-28}, organization = {AhnLab}, url = {https://asec.ahnlab.com/en/35981/}, language = {English}, urldate = {2022-06-30} } New Info-stealer Disguised as Crack Being Distributed
ClipBanker CryptBot Raccoon RedLine Stealer
2022-03-03 ⋅ Trend Micro ⋅ Trend Micro Research
@techreport{research:20220303:ioc:216aad3, author = {Trend Micro Research}, title = {{IOC Resource for Russia-Ukraine Conflict-Related Cyberattacks}}, date = {2022-03-03}, institution = {Trend Micro}, url = {https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict/IOC%20Resource%20for%20Russia-Ukraine%20Conflict-Related%20Cyberattacks-03032022.pdf}, language = {English}, urldate = {2022-03-04} } IOC Resource for Russia-Ukraine Conflict-Related Cyberattacks
ClipBanker Conti HermeticWiper PartyTicket WhisperGate
2021-12-23 ⋅ Trustwave ⋅ Trustwave SpiderLabs
@online{spiderlabs:20211223:covid19:be34a52, author = {Trustwave SpiderLabs}, title = {{COVID-19 Phishing Lure to Steal and Mine Cryptocurrency}}, date = {2021-12-23}, organization = {Trustwave}, url = {https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/covid-19-phishing-lure-to-steal-and-mine-cryptocurrency/}, language = {English}, urldate = {2022-01-05} } COVID-19 Phishing Lure to Steal and Mine Cryptocurrency
ClipBanker
2020-07-29 ⋅ ESET Research ⋅ welivesecurity
@techreport{welivesecurity:20200729:threat:496355c, author = {welivesecurity}, title = {{THREAT REPORT Q2 2020}}, date = {2020-07-29}, institution = {ESET Research}, url = {https://www.welivesecurity.com/wp-content/uploads/2020/07/ESET_Threat_Report_Q22020.pdf}, language = {English}, urldate = {2020-07-30} } THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor
2020 ⋅ Cynet ⋅ Max Malyutin
@online{malyutin:2020:threat:0895d39, author = {Max Malyutin}, title = {{Threat Research Report: Clipbanker – 13 Second Attack}}, date = {2020}, organization = {Cynet}, url = {https://www.cynet.com/attack-techniques-hands-on/threat-research-report-clipbanker-13-second-attack/}, language = {English}, urldate = {2020-09-02} } Threat Research Report: Clipbanker – 13 Second Attack
ClipBanker
2019-04-30 ⋅ ESET Research ⋅ ESET Research
@online{research:20190430:buhtrap:ebdeba3, author = {ESET Research}, title = {{Buhtrap backdoor and Buran ransomware distributed via major advertising platform}}, date = {2019-04-30}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/}, language = {English}, urldate = {2019-11-14} } Buhtrap backdoor and Buran ransomware distributed via major advertising platform
Buhtrap ClipBanker RTM

There is no Yara-Signature yet.