Resubmissions

24/08/2026, 16:58

260824-vgylns1cmd

24/08/2026, 13:26

260824-qp2k3stzbz8

General

  • Target
    eml.eml
  • Size 28KB
  • Sample260824-vgylns1cmd
  • SHA256 9c14d3cb0398e43a9e7dc3aa828be2bd2b67f0b96ad567aa5766d6531c2581bf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

File Explorer

  • eml.eml
    .eml 28KB
  • email-html-2.txt
    .html 14KB
  • email-plain-1.txt
    847B

eml.eml

  • SHA256 9c14d3cb0398e43a9e7dc3aa828be2bd2b67f0b96ad567aa5766d6531c2581bf
  • MD5 SHA1 SHA512 SSDEEP TLSH

Email Headers

Return-Path

[email protected]

Date

Mon, 24 Aug 2026 19:12:47 +0800

Subject

Urgent update required for Wing FTP Server to address critical vulnerability

Content-Type

multipart/alternative; boundary="000000000000d39a3e0659c9110a"

Received

from PH8PR09MB9835.namprd09.prod.outlook.com (2603:10b6:510:189::16) by SA0PR09MB6201.namprd09.prod.outlook.com with HTTPS; Mon, 24 Aug 2026 11:13:56 +0000

from CY5PR09CA0004.namprd09.prod.outlook.com (2603:10b6:930:1::15) by PH8PR09MB9835.namprd09.prod.outlook.com (2603:10b6:510:189::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.12; Mon, 24 Aug 2026 11:13:04 +0000

from SA2PEPF00002251.namprd09.prod.outlook.com (2603:10b6:930:1:cafe::e5) by CY5PR09CA0004.outlook.office365.com (2603:10b6:930:1::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.339.12 via Frontend Transport; Mon, 24 Aug 2026 11:13:04 +0000

from mail-qk2-x09.google.com (2607:f8b0:4864:34::9) by SA2PEPF00002251.mail.protection.outlook.com (2603:10b6:82c:400:0:1008:0:5) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.360.3 via Frontend Transport; Mon, 24 Aug 2026 11:13:03 +0000

by mail-qk2-x09.google.com with SMTP id af79cd13be357-934956d1044so101501185a.0 for <[email protected]>; Mon, 24 Aug 2026 04:13:03 -0700 (PDT)

X-Received

by 2002:a05:620a:4487:b0:937:25da:401b with SMTP id af79cd13be357-93739432986mr2276640885a.3.1787569982634; Mon, 24 Aug 2026 04:13:02 -0700 (PDT)

Received-Spf

Pass (protection.outlook.com: domain of wftpserver.com designates 2607:f8b0:4864:34::9 as permitted sender) receiver=protection.outlook.com; client-ip=2607:f8b0:4864:34::9; helo=mail-qk2-x09.google.com; pr=C

Message-Id

<CAH1bV5FfpjayXSUz2srL76oXoFe+[email protected]>

Extracted URLs

  • file https://aka.ms/LearnAboutSenderIdentification

  • file https://bbs.wftpserver.com/viewtopic.php?t=10

  • file https://www.wftpserver.com/download.htm