https://cryptpad.fr/code/#/2/code/edit/1uzjq+00+EYrAYQO2uRMLbwf/
https://www.hybrid-analysis.com/sample/97a666c84bd461bc92d84bbc8903724d9bbd953a7f22ef39b1a28b3af3c045cf/5eebee0fdce6783da5470cec
https://www.hybrid-analysis.com/sample/a3da40e89969061d1e44c3484a073a6cb75626ba103bfeedab5e9bb6f55a0292/685347db944f9d4d8b02abc1
https://www.filescan.io/uploads/6853490a3faf8fcd7d34e930/reports/29b1a2cb-f321-4216-ab14-332434493493/overview
https://www.virustotal.com/gui/file/f75b6535097fdb546e2981c6f5fbfa7bdf21430273f949c23ed8046025c19c84?nocache=1

Internet Is dead - ytcracker phonkmix

this is crap  malwares that is more noisy than 10 dimez - --   https://en.fofa.info/result?qbase64=KGljb25faGFzaD0iMTYxODU3NzcxNyIgfHwgaWNvbl9oYXNoPSI1MTk0ODY0NTMiIHx8IGljb25faGFzaD0iLTI2MDc3NDQ4MyIgfHwgaWNvbl9oYXNoPSIxNjI2OTI4NDg1Iik%3D (  (icon_hash="1618577717"  icon_hash="519486453"  icon_hash="-260774483" || icon_hash="1626928485") )

using the same malicious favicon on all ur shit -
/IOC patterns
$req0 = "<a href=\"https://alone.sellsn.io/product/50882b16-da06-40e0-a602-f2fb53c7f09a\" target=\"_blank\" class=\" transition duration-300 e"
$req1 = "<a href=\"https://twitter.com/alodotne\" target=\"_blank\" class=\"text-lg font-bold  hover:text-purple-600 transition duration-300 e"
$req2 = "<a href=\"https://webmail.alo.ne\" class=\"bg-gray-700 hover:bg-gold-dark text-white font-bold py-2 px-4 rounded shadow-md transiti"
$req3 = "<div class=\"bg-cover bg-center w-full h-full\" style=\"background-image: url('https://images.hdqwalls.com/wallpapers/abstract-dark"
$req4 = "<link href=\"https://fonts.googleapis.com/css2?family=Poppins:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,1"
$req5 = "<link rel=\"stylesheet\" href=\"https://cdnjs.cloudflare.com/ajax/libs/tailwindcss/2.2.19/tailwind.min.css\" />"
$req6 = "<meta property=\"og:image\" content=\"https://alo.ne/7az7a6\">"
$req7 = "<meta property=\"og:url\" content=\"https://main.alo.ne/\">"
$req8 = "<meta property=\"twitter:image\" content=\"https://alo.ne/7az7a6\">"
$req9 = "<meta property=\"twitter:url\" content=\"https://main.alo.ne/\">"
$req10 = "<option value=\"ageba.it\">ageba.it</option>"
$req11 = "<option value=\"alo.ne\">alo.ne</option>"
$req12 = "<option value=\"bayon.et\">bayon.et</option>"
$req13 = "<option value=\"bruis.es\">bruis.es</option>"
$req14 = "<option value=\"deni.al\">deni.al</option>"
$req15 = "<option value=\"doxi.ng\">doxi.ng</option>"
$req16 = "<option value=\"drugabu.se\">drugabu.se</option>"
$req17 = "<option value=\"excus.es\">excus.es</option>"
$req18 = "<option value=\"exitsc.am\">exitsc.am</option>"
$req19 = "<option value=\"glowi.es\">glowi.es</option>"
$req20 = "<option value=\"homicid.es\">homicid.es</option>"
$req21 = "<option value=\"karamb.it\">karamb.it</option>"
$req22 = "<option value=\"larp.money\">larp.money</option>"
$req23 = "<option value=\"larpi.ng\">larpi.ng</option>"
$req24 = "<option value=\"pinge.rs\">pinge.rs</option>"
$req25 = "<option value=\"sexu.al\">sexu.al</option>"
$req26 = "<option value=\"skid.rip\">skid.rip</option>"
$req27 = "<option value=\"supersta.rs\">supersta.rs</option>"
$req28 = "<option value=\"swatti.ng\">swatti.ng</option>"
$req29 = "<option value=\"trapst.ar\">trapst.ar</option>"
$req30 = "<option value=\"trolli.ng\">trolli.ng</option>"
$req31 = "<p class=\"text-lg\">An invite key is used to create an account, we are a private service and don't offer free services, without a"
$req32 = "<p class=\"text-lg\">Quite literally, you don't. Alo.ne is not a replacement or a competitive service, you choose alo.ne if you li"
$req33 = "<script src=\"https://code.jquery.com/jquery-3.2.1.slim.min.js\"></script>"
$req34 = "const response = await fetch('https://api.evilmail.to/check', {"

New tracks tagged # PROD: illustrious ATMOS