| ID | X0038 |
| Type | Resource Exploitation |
| Aliases | None |
| Platforms | Windows |
| Year | 2011 |
| Associated ATT&CK Software | None |
Malware used for cryptocurrency mining and clipboard hijacking.
| Name | Use |
|---|---|
| Defense Evasion::Masquerading (T1036) | Clipminer drops a file masquerading as a Control Panel (CPL) file. [1] |
| Persistence::Scheduled Task/Job (T1053) | Clipminer creates scheduled tasks for persistence. [1] |
| Name | Use |
|---|---|
| Defense Evasion::Modify Registry (E1112) | Clipminer edits the registry. [1] |
| Command and Control::C2 Communication (B0030) | Clipminer communicates to a Tor Onion Service via HTTP. [1] |
| Collection::Input Capture (E1056) | Clipminer monitors keyboard and mouse activity to determine if the machine is in use. [1] |
| Impact::Clipboard Modification (E1510) | Clipminer monitors the clipboard for cryptocurrency addresses and replaces them with ones controlled by the adversary. [1] |
| Name | Use |
|---|---|
| Execution::Install Additional Program (B0023) | Upon execution, Clipminer drops a file masquerading as a Control Panel (CPL) file. [1] |
| Impact::Resource Hijacking (B0018) | Clipminer uses sytem resources to mine for cryptocurrency. [1] |
SHA256 Hashes
- bd48b5da093a37cfa5e3929c19ac06ce711bd581bc49040e68d2ba0e5610bf71
- 1d31bea6a065fa20cf41861d21b7ea39979d40126c800ebc87d07adb41fe03f4
- 12e6883046e2c92cbe3b5706ea7f1181b44512f179c7f04e88e75f3f6e392a48
[1] https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/clipminer-bitcoin-mining-hijacking