Hostile 100% firefox 2 installs Download

TRON 1111.0.3

Clipboard exfiltration, obfuscated C2, wallet theft

“TRON”

False no-data claim with clipboard exfiltrationBrowser clipboard chunks sent over HTTP
SHA-256596fad5ac8a642c9b8dead358a033b90d708c4fde9688d2f8f82f6f2733aa14c
URLhttps://addons.mozilla.org/firefox/downloads/file/5072803/d6r1t7b4f8s3h9x-1111.0.3.xpi
MaleculeK(Am)O₄(ErEuAsCa)H₅(Br₂Cm₉Db₁₁Os₃U₄)Md₅(PaPm₂PtSi)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.