Someone was using a security flaw on my site to execute malware located on another site. I've the HTTP address of the malware on the other site, plus the IP address (and associated host) where my security flaw was being explited from. The IP address (and host) is located in Brazil.

I have two questions:
1) Is there any point in reporting this, given that the source of the issue is in Brazil?
2) If so, what is the procedure?

Yes, for the malware URL you can submit it to the mirt tool, for other info you can email me directly.