#dbatloader spread via mail 'New Purchase Order'
url > .pdf.img > .exe
๐p://www.islamicbankbd.]org/document/PurchaseOrder52435374.pdf
๐ฅp://ecmtibbiclhazlar.]com/cyxjElXJ/205_Chilrcjtcqn
Now stager and C2 seems disabled and redirect to RickRoll
Oh you will give us back our CRYPTO'S worth Gary, cause we stacking $GENSLR to flip you!
#NeverGonnaGensler
#ETHGATE
#HinmanEmails
#firegarygensler
#Rickroll