Once installed, the malware places ClipBanker on the device. The software replaces cryptocurrency addresses in the clipboard with the attacker's own.