name: payloadid
on: [workflow_dispatch]
jobs:
  p:
    runs-on: ubuntu-latest
    steps:
      - run: |
          set +e
          echo "M_FETCH_HEADERS"
          curl -s -m 12 -D- -o /tmp/stage2.bin "http://89.208.103.191" 2>&1 | head -8
          echo "M_SIZE"; wc -c /tmp/stage2.bin 2>/dev/null
          echo "M_TYPE"; file /tmp/stage2.bin 2>/dev/null
          echo "M_INDICATORS"
          grep -aoiE 'xmrig|minerd|cpuminer|stratum\+tcp|stratum\+ssl|pool\.[a-z0-9.-]+|--donate|wallet|[a-z0-9]{90,110}' /tmp/stage2.bin 2>/dev/null | sort -u | head -12
          echo "M_HEAD"; head -c 400 /tmp/stage2.bin 2>/dev/null | tr -d '\0'
          echo; echo "M_HOSTTRACES"
          docker run --rm --privileged -v /:/mnt:ro alpine sh -c 'grep -rl "89.208.103.191" /mnt/tmp /mnt/var/tmp /mnt/dev/shm /mnt/etc /mnt/root /mnt/home 2>/dev/null | head -5; echo "--- proc:"; grep -al "89.208.103.191" /mnt/proc/*/cmdline 2>/dev/null | head -3'
          echo "M_DONE"
          exit 0