[April | Malware Analysis Report] SvcStealer Targets Cryptocurrency Users: Indications of Links to Diamotrix Clipper

The SANDS Lab Threat Analysis Team selects malware each month and prepares a report.

Through expert analysis, we share malware characteristics, threat trends, and related intelligence to help create a safer cyber environment.

More detailed information on malware is available through our cyber threat intelligence service, <CTX>.

1. Overview

This report analyzes SvcStealer, a new infostealer detected through the SANDS Lab CTX platform in early 2025.

SvcStealer is a C++ information-stealing malware that collects cryptocurrency wallets, messenger data, FTP client information, system information, software lists, browser data, user documents, and other sensitive data from infected systems and sends them to an external server.

Beyond stealing information, it has a multistage modular structure that downloads and executes additional payloads from the attacker’s C2 server. The subsequent qq.exe and pxcc.exe payloads act as clippers, replacing cryptocurrency wallet addresses in the clipboard and files, respectively, with the attacker’s addresses. Victims can lose assets without realizing it, and analysis of actual transactions revealed some organized money-laundering flows.

PDB paths and the network communication structure identified during analysis also suggest that this malware likely shares a developer or attack infrastructure with previously reported Diamotrix Clipper malware.

This report examines the full SvcStealer attack flow, from initial infection through data collection and transmission, payload execution, clipping, and trace removal. It also describes financial flows associated with the attacker’s wallet transactions to assess the malware’s asset-theft objectives and threat level comprehensively. The aim is to help establish technical defenses against similar threats and provide indicators of compromise (IOCs).

2. Malware Information

In early April 2025, the SANDS Lab CTX platform detected a new infostealer, SvcStealer.

[Figure 1] Detection of ssks.exe in SANDS Lab CTX

The malware was written in C++ without packing or code obfuscation. Distributed as “ssks.exe,” it collects sensitive information from infected systems and sends it to the attacker’s server. Its broad collection targets include the following.

The malware displays no obvious UI or visible response and runs covertly in the background. It includes process detection and termination to obstruct analysis and detection, as well as trace-removal logic, giving it anti-analysis capabilities.

Collected data is compressed into a ZIP file named with a unique identifier, a 22-character string based on the volume serial number, and sent to C2 server 185.81.68.156. It uses multipart/form-data HTTP POST requests to resemble normal web traffic and evade network detection. It also ignores system proxy settings to connect directly and dynamically loads APIs rather than declaring them directly, helping evade security products.

[Figure 2] Dynamic API loading code

After stealing information, it downloads and executes “qq.exe” and “pxcc.exe” from the attacker’s server. qq.exe monitors the clipboard and replaces copied cryptocurrency wallet addresses with the attacker’s addresses. pxcc.exe searches and replaces address strings stored in documents or web directories. Both are designed to redirect transfers to attacker-controlled wallets, allowing assets to be stolen without the victim noticing.

[Table 1] Executable functions and creation times

The following PDB path was extracted from the pxcc.exe PE file.

[Figure 3] PDB path identified in pxcc.exe

This path reveals the developer’s local username (Diamotrix) and project name (FileClipper).

This suggests a connection to the known Diamotrix Clipper family, which replaces cryptocurrency wallet addresses with attacker addresses and has been documented in numerous cases. Taken together, these indicators suggest that SvcStealer was developed by the same author or a related attacker group as Diamotrix Clipper.

3. Malware Execution Sequence

On execution, the malware collects a broad range of sensitive data, including cryptocurrency wallets, messenger applications, FTP settings, screenshots, software lists, system details, open windows and running processes, browser data, and user documents.

The collected data is compressed and sent to C2 server 185.81.68.156. Further C2 communication downloads and executes qq.exe and pxcc.exe, which perform the following actions.

- qq.exe: Detects cryptocurrency wallet addresses copied to the clipboard and automatically replaces them with the attacker’s addresses (clipboard hijacking).

On execution, it copies itself as winserv.exe and registers that path as a startup entry in the registry to run automatically after reboot.

- pxcc.exe: Searches and replaces cryptocurrency wallet addresses stored in document files (file hijacking).

Finally, the malware attempts to reconnect to C2. If no response arrives, it launches itself again to resume activity. This establishes a sophisticated multistage attack extending beyond information theft to persistence, exfiltration, asset theft, and re-execution.

[Figure 4] Malware execution flow

4. Malware Analysis

4.1. ssks.exe

4.1.1. Directory Creation

The malware obtains the infected system drive’s volume serial number and performs calculations to generate a unique 22-character string. It appends this to the ProgramData path and creates “C:\ProgramData\<고유 문자열>” as a working directory for subsequent malicious activity.

[Figure 5] Unique identifier directory created under ProgramData

4.1.2. Process Monitoring to Detect Analysis Tools

The malware creates a continuously running background thread to detect and terminate processes.

The thread repeatedly enumerates processes every 1 second, looking for analysis tools. If it finds Taskmgr.exe, ProcessHacker.exe, procexp.exe, or procexp64.exe, it obtains the process handle and forcibly terminates it. This anti-analysis technique blocks tools used in research environments to obstruct detection of malicious activity.

[Figure 6] Code detecting and terminating analysis-tool processes

4.1.3. Collecting Cryptocurrency Wallet Information

It creates a Wallets subfolder in the unique working directory. Using hardcoded paths, it searches for wallet application and browser extension data under %AppData%\Local and %APPDATA%Roaming. Collected data is copied into subfolders named after each application or extension under Wallets.

The targeted applications and extensions are listed below.

[Table 2] Targeted cryptocurrency wallets and extensions

[Figure 7] Wallet and browser extension path search code

4.1.4. Collecting Messenger Application Information

It creates a Messengers subfolder in the working directory and searches hardcoded paths under %AppData%\Roaming and AppData%\Local for messenger data. Data is stored in folders named after each messenger. The targets are as follows.

[Figure 8] Messenger data collection path configuration code

Files or folders with names matching the following strings are excluded from copying.

4.1.5. Collecting FTP Client Information

It creates an FTP Clients subfolder and searches hardcoded paths for FTP client data. It targets FileZilla data at %AppData%\Roaming\FileZilla and stores it in a FileZilla subfolder under FTP Clients.

[Figure 9] FTP client data collection path configuration code

4.1.6. Capturing and Saving the Screen

The malware captures the entire screen and saves it as Screenshot.jpg in the unique working folder. It obtains screen information, initializes GDI+ (Graphics Device Interface+), retrieves the resolution, and creates a compatible device context (DC) and screen-sized bitmap. It then copies the full screen into the bitmap and saves it as a JPEG.

[Figure 10] Screen capture code for saving screenshots

4.1.7. Collecting Installed Software Information

It creates Software_Info.txt in the working folder with the headers APP, VERSION, INSTALL DATE, and IDENTIFYING NUMBER. It enumerates installed software, collecting ProductName, VersionString, InstallDate, and ProductID, and writes each entry on a separate line.

[Figure 11] Installed software information collection code

[Figure 12] Software_info.txt

4.1.8. Collecting System and Process Information

It creates System_info.txt and stores system information there. The first line contains “SvcStealer” to identify the malware, followed by collected information organized into [Machine] and [Processes] sections.

[Table 3] Collected system information

[Figure 13] Hardcoded SvcStealer identifier

[Figure 14] System_info.txt

4.1.9. Collecting Open-Window and Process Information

It creates Windows_Info.txt with the attacker’s misspelled headers “WinodowName,” “WinodowTitle,” “WinodowID,” and “ProcessName.” It enumerates all running process IDs, obtains their handles, and collects executable paths, top-level window titles (Window Title), window identifiers (Window ID), and process names.

[Figure 15] Windows_Info.txt

4.1.10. Collecting Browser Data

It creates a Browsers subfolder and steals sensitive information from Chrome, Edge, Brave, Opera, Vivaldi, Yandex, Comodo, UR_Browser, and other browsers. Login credentials, credit card details, browsing history, and download history are stored in text files named <브라우저>_Passwords.txt, <브라우저>_CreditCards.txt, <브라우저>_History.txt, and <브라우저>_Downloads.txt, respectively. Browser selection uses hardcoded numeric values mapped to specific browsers and passed as function arguments. The figure below shows the arguments and their corresponding browsers.

[Figure 16] Browser argument values and function mapping

This design makes it easy to add other browsers by changing the code.

The analyzed malware targets different browsers for each data category as follows.

[Table 4] Browsers and queries by collected data category

All collection accesses browser SQLite databases and executes SQL queries. Extracted data is formatted and saved as text files.

If collection fails, the malware logs debug messages in debug.txt. Errors include the following.

① Failure to read or decrypt browser data files

② Failure to connect to SQLite or execute a query

③ Failure to create a file for the extracted data

④ Unexpected data structure or format during processing

[Figure 17] debug.txt

4.1.11. Collecting User Documents

It creates a FileGrabber subfolder to steal documents, identifies the Desktop path, and recursively searches its subdirectories for files meeting specified conditions.

The file-filtering conditions are as follows.

- Extensions: .txt, .pdf, .sql, .cpp, .h, .dat, .wallet, .pkey

- Size limit: 1MB or less

- Attributes: Regular files, excluding directories and hidden/system files

- Excluded paths: Windows, Users, Program Files, Program Files (x86), PerfLogs, $Recycle.Bin, Boot

[Figure 18] Extension filtering code for collecting user documents

[Figure 19] User documents actually collected

Files meeting all these conditions are copied into the designated FileGrabber directory.

This primarily targets files created or frequently used by the user, deliberately excluding system and configuration files. By focusing on primary work files, it maximizes the practical value of stolen information.

4.1.12. Compressing and Uploading Collected Information

After collection, all data in the working folder is compressed into a single ZIP named with the previously generated unique string. It is then sent to server 185.81.68.156 through the following steps.

① Configuring the server connection

The malware uses INTERNET_OPEN_TYPE_DIRECT to bypass proxy settings and connect directly to the Internet, ignoring the system’s proxy or security policies to reach attacker IP 185.81.68.156 on port 80.

[Figure 20] Server connection configuration

② Constructing the HTTP POST request

To upload the ZIP, it constructs a POST request to /svcstealer/get.php with a multipart/form-data body. This resembles normal browser file uploads, providing camouflage against security detection.

The User-Agent is also set to Mozilla/5.0 to impersonate a real browser request.

[Figure 21] HTTP POST request construction 1

[Figure 22] HTTP POST request construction 2

③ Attaching file data

The ZIP is attached to the multipart request body. Headers include a fixed boundary and follow a structure resembling real web traffic, making detection harder.

④ Sending data and receiving the response

It sends the completed request and reads the response in memory to determine whether transmission succeeded.

4.1.13. Removing Collection Traces and Concealment

After collection and transmission, the malware recursively deletes the unique working folder and all files and directories beneath it.

It also removes the ZIP bearing the same name. This eliminates traces to hinder forensic analysis and detection, concealing its presence by cleaning up all files created during collection and exfiltration.

[Figure 23] Directory and ZIP deletion code

4.1.14. Downloading and Executing Payloads on C2 Commands

The malware can download and execute additional payloads from an external server.

It sends an HTTP POST to 185.81.68.156 with a body parameter in the form tsk=<식별자>. This identifier matches the working folder name derived from the volume serial number and may identify the victim system. The request goes to /svcstealer/get.php with the header Content-Type: application/x-www-form-urlencoded.

This matches web form submissions and appears intended to resemble ordinary browser traffic. The server returns a string in the following form.

[Figure 24] Browser traffic disguise code (top) and actual request (bottom)

[Figure 25] Payload download paths returned by the server

The response is split into lines at \r\n, each containing two semicolon-separated items. If the first is 0, the second is the URL of an executable to download. The malware follows these steps.

① Parsing URLs and downloading

It finds entries beginning with 0 and downloads executables from their URLs.

Data is stored in memory in binary form; the actual downloads are qq.exe and pxcc.exe.

② Saving files

Downloaded executables are saved under %LOCALAPPDATA%\Temp as temp_<랜덤숫자>.exe.

This is a standard Windows temporary folder with limited user access, making detection relatively difficult.

[Figure 26] Format of saved executables

③ Executing files

The saved files execute immediately and carry out their respective malicious functions.

4.1.15. Controlling Execution Based on C2 Responses

Immediately before exiting, the malware contacts C2 and either terminates or relaunches itself based on the response, allowing activity to continue or stop depending on communication status.

It sends an HTTP POST to 185.81.68.156 at /svcstealer/get.php with uplog=<식별자>, using the same unique identifier. If connection fails, it resends the same request to backup server 176.113.115.149. This dual-server mechanism maintains operation if the primary server is blocked or unavailable.

[Figure 27] Backup C2 connection and request code

The response may contain Ok, which determines the next action.

- If the response contains Ok, the malware exits normally.

- If Ok is absent or connection fails, it relaunches its executable and terminates the current process.

[Figure 28] Response-based execution control (restart and termination)

4.2. qq.exe

4.2.1. Preventing Duplicate Instances with a Mutex

To prevent duplicate execution, it creates a mutex named SVC_DiamoTrix. If it already exists, another instance is running and the new instance exits immediately. After creating the mutex, it calls GetLastError and checks for ERROR_ALREADY_EXISTS (0xB7), closing the handle and entering the exit routine if matched. This restricts execution to one instance per system.

[Figure 29] Mutex creation and checking to prevent duplicate execution

4.2.2. Persistence through File Disguise and Autorun Registration

To remain covertly on the system, the malware creates a Winserv directory under %AppData% and copies the running qq.exe there as winserv.exe, apparently imitating a legitimate Windows service executable. If directory creation or copying fails, it instead copies winserv.exe directly into the %App

Data% root. The file is then marked Hidden so that normal File Explorer settings do not expose it to users.

[Figure 30] File copying and Hidden attribute code

[Figure 31] Properties of the copied winserv.exe

After copying, it registers the file in the registry for automatic execution.

It first registers the current qq.exe path as SystemServices under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, then overwrites that entry with the copied winserv.exe path. This appears designed to allow the registered qq.exe to keep running even if copying winserv.exe fails.

[Figure 32] Autorun registry registration comparison (top: qq.exe; bottom: winserv.exe)

This establishes persistence by running the malware at every reboot or user logon. The Windows-like SystemServices name appears intended to avoid user suspicion and security detection.

4.2.3. Altering Cryptocurrency Addresses through Clipboard Monitoring

The malware hijacks the clipboard by monitoring cryptocurrency wallet addresses and replacing them with the attacker’s addresses.

A separate background thread performs this periodically while the main thread loops indefinitely calling sleep(50). The monitoring thread checks the clipboard every 900ms, repeating these steps.

① Detecting cryptocurrency addresses with regular expressions: The following expressions are applied to clipboard strings to identify wallet addresses.

Dash (DASH): \bX[kl][a-zA-Z0-9]{32}\b

Monero (XMR): \b4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}\b

Dogecoin (DOGE): \bD[a-zA-Z0-9]{32,34}\b

Ripple (XRP): \br[a-zA-Z0-9]{24,34}\b

Cardano (ADA): \baddr1[a-z0-9]{54}\b

Bitcoin Cash: \bbitcoincash:[a-zA-HJ-NP-Z0-9]{26,42}\b

Litecoin (LTC): \b(L|M)[a-zA-HJ-NP-Z0-9]{26,34}\b

TRON (TRX): \bT[a-zA-HJ-NP-Z0-9]{33}\b

Ethereum (ETH): \b0x[a-fA-F0-9]{40}\b

Bitcoin (BTC): \b(1|3|bc1)[a-zA-HJ-NP-Z0-9]{25,42}\b

② Automatic replacement with attacker addresses: Detected addresses are replaced with the following wallets.

BTC: 1Dk9YCCgTvoZwN3MHwhm1qqYG8P84UZbBb

ETH/ERC-20: 0x8e14fd7c5fcbd7bc4561e781b82518fe5fbb2731

TRX: TRXnBZEwvWD5SZuuEdxsPmkWyeKRGtg18K

LTC: LSjjzjgTqvksGTSW9zPtyWatcxHpQs25Bo

DOGE: DCetGnKH4gR6YevwiSQAFFgjHseqebGzU9

This exploits users’ habit of copying and pasting wallet addresses during cryptocurrency transactions, silently redirecting transfers to the attacker’s wallet.

This high-risk behavior directly causes financial loss. Because clipboard monitoring runs in a separate thread, it can remain active for long periods until the main process exits, intercepting user actions in real time while avoiding detection.

4.3. pxcc.exe

4.3.1. Altering Cryptocurrency Addresses in Saved Files

The malware performs static hijacking, searching selected directories and replacing cryptocurrency addresses in stored files with the attacker’s wallets. Going beyond clipboard monitoring, it directly modifies addresses in saved documents to broaden the attack and strengthen persistence. The sequence is as follows.

① Selecting target directories: Based on the currently logged-in username, it targets these paths.

- Personal directories (C, D, E drives): \Desktop, \Document, \Pictures, \Music, \Videos, \Downloads

- Web server directories (C, D, E drives): \xampp, \wamp64, \inetpub

② Searching directories and files: It verifies each path exists, then recursively searches all files and subdirectories under valid paths.

③ Extension filtering: Only ordinary text-based files with .txt, .htm, or .php extensions are analyzed; directories and system files are excluded.

④ Address detection and replacement: It applies the following regular expressions to file contents and replaces detected addresses with the same attacker wallets used by qq.exe.

Bitcoin (BTC): \b(?:[13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[a-zA-HJ-NP-Z0-9]{39,59})\b

Ehereum (ETH): \b0x[a-fA-F0-9]{40}\b

TRON (TRX): \bT[a-zA-Z0-9]{33}\\b|\\bT[a-zA-Z0-9]{34}\b

Litecoin (LTC): \b(?:[LM3][a-km-zA-HJ-NP-Z1-9]{26,33})\b

⑤ Modifying and saving files: It writes the modified content only when an address has actually changed. This suggests an intent to minimize changes to file integrity while avoiding anomaly detection by users or security systems.

The following is an example document whose cryptocurrency address changed after execution.

[Figure 33] Address changes before and after execution (left: before; right: after)

5. Collected / Exfiltrated Information

[Table 5] Collected / exfiltrated information

6. Conclusion

SvcStealer, a new infostealer emerging in early 2025, combines conventional information-theft capabilities with clipping through multistage execution, presenting a substantial threat. Its main module, ssks.exe, collects wallets, messenger data, FTP information, system and software details, browser data, and other sensitive information before sending it to the attacker’s server. It then downloads and executes additional C2 payloads, progressively hijacking cryptocurrency addresses in the clipboard and files.

The subsequent qq.exe and pxcc.exe monitor the clipboard and replace addresses in documents, respectively, potentially stealing funds without victims noticing. pxcc.exe particularly extends the attack across the system through static file searches, compromising user-file integrity to sustain the attack long term.

Tracing attacker wallet transactions revealed activity only in Litecoin (LTC) so far, with no Bitcoin, Ethereum, or other asset transactions found. LTC flow analysis identified a single deposit of approximately 186.2001 LTC from a Binance wallet, followed by transfers to 41 separate wallets, with some funds returning to Binance. This suggests possible laundering through repeated inflows and transfers or use of Binance as an intermediary to evade tracing. Random transfers of varying amounts differ from normal user behavior and can be interpreted as a clear pattern of organized asset concealment.

[Figure 34] Attacker LTC wallet deposits, withdrawals, and transaction flow

The malware thus extends beyond address manipulation to a sophisticated attack chain linked to actual asset theft and money laundering.

In particular, the PDB path extracted from pxcc.exe (C:\Users\Diamotrix\source\repos\FileClipper\x64\Release\

fileClipper.pdb) reveals the developer name Diamotrix and project name FileClipper, matching the previously reported Diamotrix Clipper family. The mutex name SVC_DiamoTrix contains the same string, further supporting a direct link to the developer or attack infrastructure.

Network paths collected by SANDS Lab CTX also show that SvcStealer and Diamotrix Clipper share C2 IP 185.81.68.156, with similar URL structures: /svcstealer/get.php and /diamo/post.php.

185.81.68.156 was owned by Chang Way Technologies Co. Limited, while backup IP 176.113.115.149 was registered to Cat Technologies Co. Limited. They share an address and ASN (AS57523), suggesting they are the same entity. Threat intelligence indicates that this organization has long supplied infrastructure for malicious activity to various attackers and appears to have provided the infrastructure for SvcStealer in this case.

[Figure 35] URLs related to 185.81.68.156 identified in CTX (SvcStealer and Diamotrix Clipper)

[Figure 36] IP ranges in ASN AS57523 shared by Chang Way Technologies Co. Limited and Cat Technologies Co. Limited

SvcStealer has remained active since its first detection on January 16, 2025, with detections rising sharply after mid-April. This finding is based on SANDS Lab CTX detection history, identifying the malware by /svcstealer/get.php in network requests. It suggests that distribution channels remain active or are expanding.

[Figure 37] SvcStealer detections by date

Without obfuscation or packing, SvcStealer systematically performs the full range of infostealer activities: collection, security evasion, autorun registration, trace removal, and payload execution. Its modular, flexible design supports extension and persistence, indicating an organized financial theft campaign rather than isolated code. Defending against similar threats requires blockchain-based fund tracing, stronger behavior-based detection, and coordinated responses through IoC sharing.

7. IoC Information

7.1. SHA256 Hashes

- 94B99B3D90A79F31E73049A0774E0BB690F98C51D4C9E558F5A4683051934CE1

- E77BD161308FE005519F0AC053698CA7E05A76A0FC1E6E2B9F569A1A2C080488

- E2F2EADD2865CC21F36F641BE666BEAAB4E97CCD2C56BA522846D1DD89F3A484

7.2. IP

- 185.81.68.156 (C2)

- 176.113.115.149 (C2)

7.3. URL

- hxxp://185.81.68.156/qq.exe

- hxxp://185.81.68.156/pxcc.exe

7.4. Attacker Cryptocurrency Addresses

- 1Dk9YCCgTvoZwN3MHwhm1qqYG8P84UZbBb (BTC)

- 0x8e14fd7c5fcbd7bc4561e781b82518fe5fbb2731 (ETH)

- TRXnBZEwvWD5SZuuEdxsPmkWyeKRGtg18K (TRX)

- LSjjzjgTqvksGTSW9zPtyWatcxHpQs25Bo (LTC)

- DCetGnKH4gR6YevwiSQAFFgjHseqebGzU9 (DOGE)

8. References

- https://medium.com/@joshuapenny88/hostinghunter-series-chang-way-technologies-co-limited-a9ba4fce0f65