Hostile 100% firefox 1 installs Download

TRON 1111.0.3

Clipboard exfiltration, obfuscated C2, wallet theft

“TRON”

False no-data claim with clipboard exfiltrationBrowser clipboard chunks sent over HTTP
SHA-256869cef097079fd65fffdaa58da97754d0312c93a80adfa9eb242c4e59a078568
URLhttps://addons.mozilla.org/firefox/downloads/file/5065997/b5r1t8c3f7s9d2h-1111.0.3.xpi
MaleculeK(Am)O₄(ErEuAsCa)H₅(Br₂Cm₉Db₁₁Os₃U₄)Md₅(PaPm₂PtSi)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.