This payload is currently being distributed using the Shellshock vulnerability

I see some Portuguese variable names. That suggests to me that one or more of the people involved are from Brazil.