This payload is currently being distributed using the Shellshock vulnerability (gist.github.com)

I see some Portuguese variable names. That suggests to me that one or more of the people involved are from Brazil.