Stay safe from the BTC clipper. Dangerous malware

Lipstick Spoiler

Lipstick Spoiler

Supreme Member
Jr. VIP
Joined
Aug 10, 2022
Messages
1,410
Reaction score
914
Hey guys, so just today only, i was setting up my shop and filling crypto details.
I copied my BTC and ETH address in my mobile, and i sent it to telegram web.
From there, i copied it, and when i was pasting it in my shop, the BTC address was different from my own wallet address. Luckily, i noticed this. I thought this would be some sort of a glitch, so i again copied, but boom, again the same btc address which was different from mine. I copied eth and ltc address too, but again, the pasted address was different from the copied one. I was scratching my head, and Googled it.

I found it was some sort of a malware that was doing it, and it was present in my computer. Damn!! I was seriously blown away.

Please guys, you also check it if there's anything present of that sort or not. I had a file by the name davire.exe, and I deleted it, and now the copy and paste, both are same.

I am still a bit paranoid, so i have decided to format my laptop, and i purchased mega.nz for transferring my data.


I found a tool which detects it for you. If mods allow me, i can post that here.

But please be safe, and do the experiment of copy pasting to see if there's any stealer present.
 
Advertise on BHW
yea this malware has been around for a while, luckily it is not very stealth so easy to remove.
however there might be more on your system, so yes formating and re-install is always a good idea after compromise.
just make sure that the malware is not in your backed up data as well ;)
 
itz_styx said:
however there might be more on your system, so yes formating and re-install is always a good idea after compromise.
just make sure that the malware is not in your backed up data as well ;)
Click to expand...
yes i read it that it goes into the hardware lol

I have purchased the Malwarebytes now. Let's scan the computer and transfer the data.
 
So this malware look for crypto addresses in Windows clipboard(copy and paste data) and alters the address to the attackers address to trick the user to send crypto the attackers address instead .That is so simple to code,The scams that people think of is getting out of hand the recession will make it worse.
 
Ahhh. Crypto Clippers. I thought they were extinct. Could you send me those adresses or would you check them how much they recieved -> (BTC Explorer)
 
What I do to avoid constant copying pasting my address on my pc is
Put my address(s) (eth/btc/poly etc) and their QR code in an encrypted notepad like standard notes
and when need it, i just open it up on my phone and grab it.
Another way is if you have a Web3 profile like UD.me can just grab it from there.
or i just use my wallet on my phone to copy there instead :)
 
Lipstick Spoiler said:
yes i read it that it goes into the hardware lol

I have purchased the Malwarebytes now. Let's scan the computer and transfer the data.
Click to expand...
nah this one doesn't use a hardware rootkit. that would make it persistent even after you format and you wouldn't see the .exe and easily delete it, it would be hidden from AVs and anti malware scanners.
and if you use a recovery cd to delete it, it would be re-created as no AV or malware scanner can get rid of hardware backdoors sofar. that would have to be done manually and won't be easy.
don't worry though these backdoors are never used by scammers as they arent advanced enough to code that type of malware.
these rootkits are only used by real hackers and nation states to hide their malware ;)

xReminisce said:
What I do to avoid constant copying pasting my address on my pc is
Put my address(s) (eth/btc/poly etc) and their QR code in an encrypted notepad like standard notes
and when need it, i just open it up on my phone and grab it.
Another way is if you have a Web3 profile like UD.me can just grab it from there.
or i just use my wallet on my phone to copy there instead :)
Click to expand...
that can also be intercepted, besides there is the same type of malware for phones as well.
 
itz_styx said:
nah this one doesn't use a hardware rootkit. that would make it persistent even after you format and you wouldn't see the .exe and easily delete it, it would be hidden from AVs and anti malware scanners.
and if you use a recovery cd to delete it, it would be re-created as no AV or malware scanner can get rid of hardware backdoors sofar. that would have to be done manually and won't be easy.
don't worry though these backdoors are never used by scammers as they arent advanced enough to code that type of malware.
these rootkits are only used by real hackers and nation states to hide their malware ;)


that can also be intercepted, besides there is the same type of malware for phones as well.
Click to expand...
But you know there hardware backdoors like intel management engine and amd psp built in that the US goverment have control of.
 
moonshine7000 said:
But you know there hardware backdoors like intel management engine and amd psp built in that the US goverment have control of.
Click to expand...
i know about that as well as SMM based kits, thats why i said "nation states" have access to this type of backdoors.
 
AlexSeiler said:
Ahhh. Crypto Clippers. I thought they were extinct. Could you send me those adresses or would you check them how much they recieved -> (BTC Explorer)
Click to expand...
Umm sorry dude, i forgot to copy them. They would have raked in some bucks of course. I'm poor, so they couldn't get anything from me lol
 
You want to say that your system got infected and that is why this was happening ?
 
moonshine7000 said:
So this malware look for crypto addresses in Windows clipboard(copy and paste data) and alters the address to the attackers address to trick the user to send crypto the attackers address instead .That is so simple to code,The scams that people think of is getting out of hand the recession will make it worse.
Click to expand...

It's quite worrying that a lot of people will not notice this too, just run a copy and paste and send.
 
Watch out when transferring data, as advanced malware can bind to existing files. In your case, it seems like the virus was detected and removed, but another full scan using different software won't hurt.
 
onlinemarketer12 said:
You want to say that your system got infected and that is why this was happening ?
Click to expand...
Yes, try to copy btc address, and when you paste, make sure it is the same. If it isn't, you have the btc clipper malware. I think i downloaded some not so known extensions, and then his happened.
 
agedaccs said:
What did you download or do recently to get this malware into your computer?
Click to expand...
I don't know bro. I was copying and pasting my btc address, and luckily i noticed that it got changed, so i did it again for eth and ltc. Then also, it got changed, then i Googled it. Luckily i found the solution. Maybe I had downloaded some cracked software or exe or any chrome extension.
 
Lipstick Spoiler said:
I don't know bro. I was copying and pasting my btc address, and luckily i noticed that it got changed, so i did it again for eth and ltc. Then also, it got changed, then i Googled it. Luckily i found the solution. Maybe I had downloaded some cracked software or exe or any chrome extension.
Click to expand...
Cracked software most likely. Did you have an antivirus installed before you got infected?
Also I can vouch for Malwarebytes, I've been using it for 1 year.
 
SigmaMale said:
Cracked software most likely. Did you have an antivirus installed before you got infected?
Also I can vouch for Malwarebytes, I've been using it for 1 year
Click to expand...
i mostly use rdp, so i don't have any issues as such. But yeah, i use av in my original computer for sure.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top