@beardalaxy @miria @matrix @LouisConde The code's obfuscated, but it's just stringing together b64 buffers

it fetches
https://api.ipgeolocation.io/ipgeo?apiKey=ae511e1627824a968aaaa758a5309154

takes it into JSON, then looks at if res.country_name.is "russia" or "belarus"

then if that's true it calls the h() function for each of "./" "../" "../../" "/" and then calls itself recursively on any other files and overwrites them with "❤"

Guessing it does it in that order to maximise impact before someone notices