Second stage shellcode The second stage shellcode will then perform the following actions:  Download the final payload (FinSpy) from hxxp://89.45.67[.]107/rss/mo.exe Download a lure document to display to the victim from the same IP Execute the payload and display the lure document  Payload – mo.exe As mentioned earlier, the “mo.exe” payload (MD5: 4a49135d2ecc07085a8b7c5925a36c0a) is the newest version of Gamma International’s FinSpy malware, typically sold to nation states and other law enforcement agencies to use in lawful surveillance operations.  This newer variant has made it especially difficult for researchers to analyze the malware due to many added anti-analysis techniques, to include a custom packer and virtual machine to execute code