Malformed FileZilla FTP client with login stealer

avast antivirus blog ^ | January 27th, 2014 | Malware Analyst Workforce

[Utilizer]

Beware of malformed FileZilla FTP client versions 3.7.3 and 3.5.3. We have noticed an increased presence of these malware versions of famous open source FTP clients.

The first suspicious signs are bogus download URLs...

Malware installer GUI is almost identical to the official version. The only slight difference is version of NullSoft installer where malware uses 2.46.3-Unicode and the official installer uses v2.45-Unicode. All other elements like texts, buttons, icons and images are the same.

The installed malware FTP client looks like the official version and it is fully functional! You can’t find any suspicious behavior, entries in the system registry, communication or changes in application GUI.

The only differences that can be seen at first glance are smaller filesize of filezilla.exe (~6,8 MB), 2 dll libraries ibgcc_s_dw2-1.dll and libstdc++-6.dll (not included in the official version) and information in “About FileZilla” window indicates the use of older SQLite/GnuTLS versions. Any attempt to update the application fails, which is most likely a protection to prevent overwriting of malware binaries.

[Scrambler Bob]

M4L

[DJ MacWoW]

Did You Know?

The Current FReepathon Pays For The Current Quarters Expenses?

Please Donate And Keep FR Running

[Utilizer]

I generally use download.cnet.com.

SourceForge and Freecode are quite reliable. Some would argue more so.

[carlo3b]

I’m sorry I am so uneducated with computers, but I know my computer has been hacked.. I downloaded FileZilla, but don’t know how to run the program, can anyone help.. I know, I’m an idiot..

[unlearner]

Thanks for posting this info. Fortunately, my copy seems to have been unaffected, but I passed this along to other users.

[expat1000]

“My favorite advice. Heck, at least half the LEGIT download sites want to use their own damn installable downloader,”

Yep. We mostly don’t need sophisticated downloaders any more so what’s up with those? I don’t know nor care. I prefer to download from the developer’s own site whenever possible.