Looks like a typical perl based botnet from russia used to send spam. <a href="https:&#x2F;&#x2F;www.korelogic.com&#x2F;Resources&#x2F;Presentations&#x2F;botnets_issa.pdf" rel="nofollow">https:&#x2F;&#x2F;www.korelogic.com&#x2F;Resources&#x2F;Presentations&#x2F;botnets_is...</a><p>I forgot where I read more about those previously, but my guess is definitely russia. maybe reddit &#x2F;netsec has more info