Researchers Detail AnimateClipper and Efimer Crypto-Clipboard Malware

Oct 30, 2026 · Original article ↗

Summary

ReversingLabs examines how AnimateClipper and Efimer replace copied cryptocurrency wallet addresses, including address-matching methods, evasion features, distribution, and ways users can reduce risk.

Key points

Clipper malware monitors copied text for cryptocurrency wallet addresses and replaces them with attacker-controlled addresses, potentially redirecting payments.
AnimateClipper identifies wallet patterns and swaps addresses within the same cryptocurrency ecosystem; it has been distributed through fake software and ClickFix, sometimes alongside infostealers.
Efimer matches leading or trailing address digits to make replacement addresses less noticeable, and can also exfiltrate clipboard data and screenshots.
Efimer uses anti-analysis measures, Pyarmor protection, XOR-encrypted payloads, obfuscated JavaScript, and intermittent TOR-based C2 communications; the article says it can also receive commands.
The researchers report that Efimer builds were generated hourly and that both Efimer and AnimateClipper became inactive soon after the research was completed.
The article describes CryptoBandit as a related family that likely evolved from Efimer, based on code overlap and shared address-matching behavior.
Recommended precautions include avoiding fake software and ClickFix prompts, not using PowerShell for identity verification, and checking wallet addresses carefully before sending.

Article Details

Attack Vectors: AnimateClipper is distributed through fake software installs and ClickFix, sometimes alongside infostealers.
Efimer has been distributed through phishing emails, fake torrent sites, fake software, and fake error ClickFix prompts.
The malware monitors copied cryptocurrency wallet addresses and replaces them with attacker-controlled addresses.
Efimer can exfiltrate clipboard data and screenshots and communicate with its C2 over Tor.
Defensive Notes: Be cautious of software downloads from untrusted sources and identity-verification prompts asking users to run PowerShell.
Check files for malicious indicators before running them.
Carefully verify cryptocurrency wallet addresses before sending transactions, including after copying and pasting.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`celebration-internet[.]cc`	Listed as an AnimateClipper C2 hostname.
HOSTNAME	`kffd3[.]vexlatech[.]cc`	Listed as an AnimateClipper C2 hostname.
HOSTNAME	`kkc[.]vogueatelier[.]cc`	Listed as an AnimateClipper C2 hostname.
HOSTNAME	`lb[.]propertyfind[.]cc`	Listed as an AnimateClipper C2 hostname.
HOSTNAME	`static[.]quorashift[.]cc`	Listed as an AnimateClipper C2 hostname.
SHA256	`31876a3a26a0f92a001dcae2b84174bb9f47af9208f7a92b6e160b1931899b01`	Hash of an Efimer PyInstaller sample in the article's example sample list.
SHA256	`3cc7dab11f0f333fad56e428efaa638ccbf7af16eb4dfc8dab2621732fb22d92`	Hash of an Efimer PyInstaller sample in the article's example sample list.
SHA256	`a77b9a651bd09e64215bdfc65d99fe93bff5dfa8a50748f02bf5d9b699399736`	Hash of an Efimer PyInstaller sample in the article's example sample list.
SHA256	`bb796bb63f6985e75dbb6c1f8eb8640dee859f989f09a4a2fd9102d33918139b`	Hash of an Efimer PyInstaller sample in the article's example sample list.
SHA256	`d91e69f6cfc7d484a6a67de2e65712e995590af17a419b0b0c1ea22de3d2f81f`	Hash of an Efimer PyInstaller sample in the article's example sample list.
SHA256	`e46f514e456c5e27f60854e4156234e6ae8c4dd5892ddb4d2d557de02fc2cd15`	Hash of an Efimer PyInstaller sample in the article's example sample list.
URL	`hxxp[:]//167[.]233[.]30[.]202/files/9je7p2.exe`	Efimer executable payload location listed by the article.
URL	`hxxp[:]//167[.]233[.]30[.]202/files/swfe60.exe`	Efimer executable payload location listed by the article.
URL	`hxxp[:]//167[.]233[.]30[.]202/files/wjpr1q.exe`	Efimer executable payload location listed by the article.
URL	`hxxp[:]//167[.]233[.]30[.]202/files/xgc6jp.exe`	Efimer executable payload location listed by the article.
URL	`hxxp[:]//64[.]89[.]161[.]122/SW.exe`	AnimateClipper executable payload URL listed in the article.
URL	`hxxp[:]//webenvysolutions[.]com/composer.php`	Efimer payload location listed by the article.
URL	`hxxps[:]//91[.]92[.]47[.]8/quis.exe`	AnimateClipper executable payload URL listed in the article.
URL	`hxxps[:]//cim-kolea[.]com/3.exe`	AnimateClipper executable payload URL listed in the article.
URL	`hxxps[:]//hasansunnah[.]xyz/composer.dat`	Efimer payload location listed by the article.
URL	`hxxps[:]//hindustanagency[.]com/666.exe`	AnimateClipper executable payload URL listed in the article.
URL	`hxxps[:]//kupunasvolpiano[.]com/g/static/s/cinzel/v23/Taskforce.exe`	AnimateClipper payload URL listed in the article.
URL	`hxxps[:]//microlsireqjn[.]com/nvd_driver_dll.exe`	AnimateClipper executable payload URL listed in the article.
URL	`hxxps[:]//muaklekcoop[.]com/js/quis.exe`	AnimateClipper executable payload URL listed in the article.
URL	`hxxps[:]//peniclean[.]com/nvd_driver_dll.exe`	AnimateClipper executable payload URL listed in the article.
URL	`hxxps[:]//peowlakjew[.]com/clean_driver_dll.exe`	AnimateClipper executable payload URL listed in the article.
URL	`hxxps[:]//thepullmanfolkestone[.]com/ppisondeers.exe`	AnimateClipper executable payload URL listed in the article.
URL	`hxxps[:]//tuasesoriadigital[.]es/default.dat`	Efimer payload location listed by the article.
URL	`hxxps[:]//voedseltuinijplein[.]nl/composer.dat`	Efimer payload location listed by the article.
URL	`hxxps[:]//wantsellonline[.]com/1.exe`	AnimateClipper executable payload URL listed in the article.