CryptoBandits — Windows Crypto Clipper, Tor Backdoor & USB LNK Worm

CryptoBandits (Microsoft: Trojan:Win32/CryptoBandits, with JS variants Trojan:JS/CryptoBandits.A/.B) is a lightweight Windows cryptocurrency clipper blended with a backdoor and a USB worm. Microsoft Threat Intelligence and Defender Experts identified it as active since February 2026 and disclosed it on 2026-06-17. It relies on Windows Script Host (WSH) and ActiveX-driven logic — there is no traditional installer and no exposed IP-based C2 — to launch a bundled portable Tor client (ugate.exe) and poll a hidden-service (.onion) command-and-control server through a local SOCKS5 proxy on 127.0.0.1:9050.

The clipper polls the clipboard roughly every 500 ms, hunting for BIP39 seed phrases (12/24 words), Ethereum/Bitcoin WIF private keys, and recipient wallet addresses (legacy/P2SH/Taproot/Bech32 BTC, Tron, Monero). When it sees a recipient address it substitutes an attacker-controlled wallet address into the clipboard so the victim unwittingly pays the attacker, and it exfiltrates seeds/keys and screenshots over Tor. If the C2 returns an EVAL response the malware executes remote code, giving it a real backdoor. As a crude anti-analysis check it exits if Task Manager is running.

It is self-spreading: it drops a malicious Windows Shortcut (.lnk) onto USB storage devices, hides the legitimate DOC/XLSX/PDF files, and creates same-named LNK shortcuts whose arguments launch the worm component. Opening one checks whether the machine is already infected and only fetches the payload (cfile staging via /stub.php) from a remote server if absent. Persistence is two indefinite scheduled tasks — one for USB propagation, one for the stealer/clipper.

Decisions: Unlike most fresh malware drops, Microsoft published a full atomic IOC set (hashes + .onion + filenames + endpoints) — so this pack is both IOC-keyed and behavior-keyed. We lead with the published atomics (block the 16 hashes, alert the 10 onions) and back them with durable behavioral hunts on the WSH/Tor/SOCKS5/LNK-worm chain, because the actor can trivially re-roll hashes and rotate onions. Every atomic in §4/§10 traces to the Microsoft IOC table; hunt artifacts (behaviors, paths, ports) are labelled separately.

Working hypothesis: A user mounts an infected USB device (or runs an existing infection) and double-clicks a legitimate-looking shortcut. The hidden LNK argument invokes wscript/cscript/mshta against a bundled WSH/JS payload, which checks for prior infection, fetches cfile via /stub.php if needed, launches the portable Tor client (ugate.exe) bound to a local SOCKS5 proxy (127.0.0.1:9050), and registers two scheduled tasks. The clipper then polls the clipboard, substitutes wallet addresses, captures screenshots, and beacons to an .onion C2 over Tor — executing EVAL commands as a backdoor. Meanwhile the worm component re-arms any newly attached USB media with same-named LNKs.

Hunt hypotheses (fidelity-ordered)

• H1 (high): A script host (wscript/cscript/mshta) launches from a removable-drive root or a temp path → Q1. Near-zero benign baseline.
• H2 (high): Mass creation of .lnk files by a single process in a short window (USB re-arming) → Q5.
• H3 (high): Any process connecting to a local SOCKS5 proxy at 127.0.0.1:9050 (or 9150) → Q3 — strong Tor-tunneling signal.
• H4 (high): Execution of the bundled Tor binary ugate.exe, or a known worm-component SHA256 → Q4 (IOC-keyed).
• H5 (medium): A WSH/script host spawning curl.exe / certutil for an outbound fetch → Q2 (payload staging).
• H6 (medium): Scheduled-task or Run-key persistence created by a script host (the two indefinite tasks) → Q6.

Grouped IOC Quick-Copy

All atomics below are from the Microsoft Security Blog IOC table (2026-06-17): 16 worm-component SHA256, 10 .onion C2, filenames, and C2 URI paths. Behavioral signatures and a version/host audit follow. Every value traces to that published source.

type,value,action,severity,expiration,description,tags
sha256,7630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68c,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,a7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,23c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b43,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,cf9fc891ea5ca5ecd8113ef3e69f6f52ff538b6cccbdaa9559106fc72bc6da30,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,100407796028bf3649752d9d2a67a0e4394d752eb8de86daa42920e814f3fae8,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,d14b80cbd1a19d4ad0473a0661297f8fdf598e81ff6c4ab24e212dcad2e54b3f,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,9d90f54ae36c6c5435d5b8bed40faf54cc91f6db28574a6310b5ffaeb0362e96,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,67fc5cf395e28294bbb91ed0e954fdf2e80ebd9119022a115a42c286dc8bacf5,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,0020d23b0f9c5e6851a7f737af73fd143175ee47054931166369edd93338538a,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,35a6bc44b176a050fd6824904b7604f0f45b0fdfa26bf9500b9e05973b387cfd,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,c824630154ac4fdfce94ded01f037c305eab51e9bef3f493c60ff3184a640502,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,d43bf94f0cb0ab97c88113b7e07d1a4024d1610617b5ad05882b1dbab89e15ba,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,b2777b73a4c33ac6a409d475057843be6b5d32262ef28a1f1ff5bb52e3834c5f,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,7787a9a7d8ae393aa32f257d083903c4dc9b97a1e5b0458c4cd480d4f3cb5b05,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,f3b54984caca95fd496bcfe5d7db1611b08d2f5b7d250b43b430e5d76393f9e0,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits
sha256,20db98af3037b197c8a846dbf17b87fc6f049c3e0d9a188f9b9a74d3916dd5e1,prevent,critical,2027-06-19,CryptoBandits worm component (MS IOC),campaign:CryptoBandits

# CryptoBandits Tor hidden-service C2 (Microsoft IOC table, 2026-06-17)
cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion
gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad.onion
he5vnov645txpcv57el2theky2elesn24ebvgwfoewlpftksxp4fnxad.onion
lyhizqy2js2eh6ufngkbzntouiikdek5zsdj3qwa22b4z6knpqorgiad.onion
j3bv7g27oramhbxxuv6gl3dcyfmf44qnvju3offdyrap7hurfprq74qd.onion
shinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid.onion
7goms4byw26kkbaanz5a5u5234gusot7rp5imzc3ozh66wwcvmcudjid.onion
facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion
wt26llpl5k6gok3vnaxmucwgzv2wk3l7nuibbh25clghrtus3p5ctsid.onion
ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion
# C2 endpoints: /route.php (beacon) /recvf.php (screenshot upload) /stub.php (payload)
# Local Tor SOCKS5 proxy: 127.0.0.1:9050   Bundled Tor binary: ugate.exe   Staging file: cfile

wscript/cscript/mshta launched from a removable-drive root or %TEMP% with a .lnk/.js/.vbs/.hta argument
WSH script host spawning curl/certutil/bitsadmin to fetch a payload (cfile via /stub.php)
Non-browser process connecting to a local Tor SOCKS5 proxy at 127.0.0.1:9050 (or 9150)
Execution of bundled portable Tor binary ugate.exe (verify against published SHA256)
Single process creating many same-named .lnk files on a removable drive (USB worm re-arming)
schtasks /create or Run-key write parented by wscript/cscript/mshta (two indefinite tasks)
Clipboard polled ~every 500ms; recipient wallet address substituted with attacker address
Clipper terminates when taskmgr.exe (Task Manager) is detected running (anti-analysis)

# Microsoft Defender detection names (MS write-up):
#   Trojan:Win32/CryptoBandits.A / .B
#   Trojan:JS/CryptoBandits.A / .B
#   "Suspicious JavaScript process"  |  "Possible data exfiltration using Curl"
# Windows - find a listener/connection on the Tor SOCKS5 port:
netstat -ano | findstr "127.0.0.1:9050"
# Windows - list the two suspect scheduled tasks (review actions for wscript / ugate.exe):
schtasks /query /fo LIST /v | findstr /i "wscript cscript ugate"
# Windows - surface hidden originals + rogue shortcuts on a mounted USB (read-only review):
dir /a:h E:\   &   dir E:\*.lnk
# Clipboard-targeted assets at risk: BIP39 12/24-word seeds, ETH/BTC WIF keys,
#   BTC legacy(1)/P2SH(3)/Taproot(bc1p)/Bech32(bc1q), Tron(T..), Monero(4../8..)

CryptoBandits is delivered by removable media and executed through Windows Script Host, so the highest-leverage controls are USB access control and disabling / constraining WSH. Platforms touched: Windows endpoints, AD/Intune policy, and network egress (Tor). Mitigations reference MITRE M-codes.

Playbook A · Disable WSH + block JS/VBS-from-USB ASR (Windows, PowerShell)

# 1. Disable Windows Script Host (both views) - kills wscript/cscript execution
New-Item   "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" -Force | Out-Null
Set-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" Enabled 0 -Type DWord
New-Item   "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings" -Force | Out-Null
Set-ItemProperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows Script Host\Settings" Enabled 0 -Type DWord

# 2. ASR: block JS/VBScript from launching downloaded executable content (GUID d3e037e1-3eb8-44c8-a917-57927947596d)
Add-MpPreference -AttackSurfaceReductionRules_Ids d3e037e1-3eb8-44c8-a917-57927947596d -AttackSurfaceReductionRules_Actions Enabled
# ASR: block untrusted/unsigned executables from USB (b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4)
Add-MpPreference -AttackSurfaceReductionRules_Ids b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 -AttackSurfaceReductionRules_Actions Enabled
# Verify: Get-MpPreference | Select -Expand AttackSurfaceReductionRules_Ids

Playbook B · Restrict USB mass-storage & deny autorun (GPO / registry)

# Deny installation of removable storage device classes (Intune / GPO: Device Installation Restrictions)
# HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceInstall\Restrictions
DenyRemovableDevices            = 1
# Disable Autorun/Autoplay on all drives:
# HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoDriveTypeAutoRun             = 0x000000FF   # 255 = disable autorun on every drive type
# Optional: force removable drives read-only (StorageDevicePolicies)
# HKLM\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies
WriteProtect                  = 1
# Apply: gpupdate /force

Playbook C · Hunt & remove the two scheduled tasks + Tor binary (PowerShell)

# Find scheduled tasks whose action runs a script host or ugate.exe
Get-ScheduledTask | Where-Object {
  ($_.Actions.Execute -match 'wscript|cscript|mshta|ugate')
} | Select-Object TaskName, TaskPath, @{n='Run';e={$_.Actions.Execute}}
# Remove a confirmed-malicious task (replace name after review):
# Unregister-ScheduledTask -TaskName "<BadTaskName>" -Confirm:$false
# Locate the bundled Tor binary and any cfile staging artifact:
Get-ChildItem -Path C:\Users -Recurse -Include ugate.exe,cfile -EA SilentlyContinue |
  Select-Object FullName, Length, LastWriteTime
# Check for a listener on the Tor SOCKS5 port:
Get-NetTCPConnection -LocalPort 9050 -EA SilentlyContinue | Select LocalAddress,State,OwningProcess

Validation gates: (1) confirm ProcessRollup2 retains CommandLine/ParentBaseFileName and the file-write feed captures .lnk; (2) Q1/Q3 return zero hits in a 30-day benign lookback after IT-script and Tor-Browser exclusions; (3) load the 16 hashes + 10 onions into IOC Management and confirm Q4 matches a planted test hash; (4) lab-validate Q1/Q3 with benign harnesses — never the live malware; (5) promote Q1/Q3 to Custom IOA Detect+Block (target FP < 1/week). The clipboard read/address-swap step is an accepted detection gap — mitigated by WSH/USB hardening and user re-verification of pasted addresses.

HuntPack v0.1 · CryptoBandits (Trojan:Win32/CryptoBandits crypto clipper / Tor backdoor / USB LNK worm) · Generated 2026-06-19 · Defensive use only — no malware code. Every atomic IOC traces to the Microsoft Security Blog IOC table (2026-06-17); behavioral hunts cover the WSH/Tor/SOCKS5/LNK-worm chain and are durable against hash/onion rotation. Validate field names (especially the loopback-network and file-write feeds) in your tenant before promoting any query to alerting.