{"id":"f31bae04dadf2712d4e4d82a96a56156","title":"Worm.ClipboardHijacker — Worm.ClipboardHijacker · 木马/恶意软件 · PE32","md5":"f31bae04dadf2712d4e4d82a96a56156","sha256":"db0424208bbbb7fa162719bfc67b6d36c33caf7c924e6b675312adbd26d9634d","family":"Worm.ClipboardHijacker","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"C++","file_format":"PE32","compiler":"MSVC2008","published_at":"2026-08-07T16:00:00.000Z","summary":"该样本是一款综合型 Windows 蠕虫，由 Microsoft Visual C++ 2008 编译，具备以下核心恶意能力：蠕虫传播：通过USB驱动器（.lnk快捷方式）和网络共享复制自身为 DrvSvcsrMgrsvr.exe，利用 UPnP 协议进行 NAT 穿透（AddPortMapping/DeletePortMapping），实现内网穿透和外网可达。剪贴板劫持：监控系统剪贴板，识别比特币现金 (bitcoincash:)、Cosmos (cosmos)、Ronin (ronin:) 和 Nano (gnano_) 等加密货币地址，替换为攻击者控制的地址。C2 通信：连接 178.16.54.109 和 178.16.55.240（WinINET HTTP），下载更新和上传窃取数据。持久化：通过 Run 注册表键值和 .lnk 快捷方式实现开机自启动。反取证：使用 RC4 加密通信数据，绕过 Mark of the Web 检测。","url":"https://zseceye.com/report/f31bae04dadf2712d4e4d82a96a56156","json_url":"https://zseceye.com/report/f31bae04dadf2712d4e4d82a96a56156.json","html_url":"https://zseceye.com/report/f31bae04dadf2712d4e4d82a96a56156","hash_urls":{"md5":"https://zseceye.com/hash/f31bae04dadf2712d4e4d82a96a56156","sha256":"https://zseceye.com/hash/db0424208bbbb7fa162719bfc67b6d36c33caf7c924e6b675312adbd26d9634d"},"search_urls":{"md5":"https://zseceye.com/?q=f31bae04dadf2712d4e4d82a96a56156","sha256":"https://zseceye.com/?q=db0424208bbbb7fa162719bfc67b6d36c33caf7c924e6b675312adbd26d9634d"},"sample_download_url":"https://zseceye.com/report/f31bae04dadf2712d4e4d82a96a56156/sample","sample_filename":"db0424208bbbb7fa.zip","iocs":[],"ips":[]}