This payload is currently being distributed using the Shellshock vulnerability

gist.github.com

6 pointsjnotarstefano1 comment

I see some Portuguese variable names. That suggests to me that one or more of the people involved are from Brazil.