Hostile 100% firefox 2 installs Download

TRON 1111.0.3

Clipboard exfiltration, obfuscated C2, wallet theft

“TRON”

False no-data claim with clipboard exfiltrationBrowser clipboard chunks sent over HTTP
SHA-256df0e84cc740d9c7b23b825f632aca22ef61a1b74e9e108c6319fc1f8e750d8ed
URLhttps://addons.mozilla.org/firefox/downloads/file/5069375/x6b1t9d4f3h7s8w-1111.0.3.xpi
MaleculeK(Am)O₄(ErEuAsCa)H₅(Br₂Cm₉Db₁₁Os₃U₄)Md₅(PaPm₂PtSi)

Evidence

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.