Animateclipper Cryptocurrency Clipboard Replacer
This rule detects potential Animateclipper malware or similar cryptocurrency clipboard hijackers by identifying the presence of Windows API calls related to clipboard manipulation (GetClipboardData, SetClipboardData) in conjunction with regular expressions for common cryptocurrency addresses (Bitcoin, Ethereum) and the keyword 'clipboard'. The rule triggers if at least three of these indicators are present, suggesting an attempt to monitor and replace cryptocurrency addresses copied to the clipboard.
YARA
