text:  Mirai/Gafgyt dropper scripts or variants  Perl Shellbot  Coinminer activity  Webshell downloads (full injected command)  Callback/Scanning activity  Direct Download exploits where payloads were no longer live at the time of analysis:  Sample hashes  801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637 6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b 940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8 fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05 85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03  bot.v 0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba C2 server : 5[.]39.217.212:80