Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
Threat Intelligence | Analysis of a Fake TronLink Chrome Extension Phishing Campaign
Excerpt
Background Recently, the SlowMist MistEye security monitoring system captured a high-risk phishing sample targeting TRON wallet users. The sample disguises itself as a Chrome MV3 (Manifest V3) extension related to the TRON wallet ecosystem, constructing a complete wallet credential theft chain through a combination of brand impersonation and remotely variable UI loading. The attack technique is divided into two layers: the first layer is a fake TronLink Chrome extension that…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | trx-scan-explorer.org | High | Score 58/100 | First seen |
| MD5 | ce612d027e631d6633582227eb29002f | Medium | Score 53/100 | First seen |
| SHA256 | 6b4a4b64e6f969017cb3a9a71dd3038ddf32b989e5342dbbe36650d5802f2ee4 | Medium | Score 53/100 | First seen |
| URL | https://tronfind-api.tronfindexplorer.com/api/visitor/sync | High | Score 58/100 | First seen |
| SHA256 | b84b89f0a1b7f00431274ac676104acaaa73d440e5731161d1077e733014cc29 | Medium | Score 53/100 | First seen |
| SHA256 | 0cbf4f21cf157227d2c3fba80b64e1f4c3f9d2cc0bf926e024252c35e93edd5a | Medium | Score 53/100 | First seen |
| URL | https://tronfind-api.tronfindexplorer.com/* | High | Score 58/100 | First seen |
| SHA1 | 94d651b42355f2b0765a7435e5a5927623807225 | Medium | Score 53/100 | First seen |
| URL | https://tronfind-api.tronfindexplorer.com/api/visitor/track | High | Score 58/100 | First seen |
| URL | https://tronfind-api.tronfindexplorer.com/api/visitor/create | High | Score 58/100 | First seen |
| URL | https://tronfind-api.tronfindexplorer.com/api/visitor/enrich | High | Score 58/100 | First seen |
| URL | https://tronfind-api.tronfindexplorer.com/ | High | Score 58/100 | First seen |
| URL | https://tronfind-api.tronfindexplorer.com/api/data/words | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…