This payload is currently being distributed using the Shellshock vulnerability (opens in new tab)

I see some Portuguese variable names. That suggests to me that one or more of the people involved are from Brazil.