1/7/2023 0 Comments Filezilla malware warningThis malicious version has been compiled way back in September 2012, and is still detected by just a couple of Antivirus solutions. Malware doesn't search bookmarks or send any other files or saved connections," Avast explains. "Login details are sent to attackers from the ongoing FTP connection only once. The modified version copies the login information of the user and sends it to a server that is apparently in Germany, and same IP address of the server hosts three other domains, which are also associated with malware and spam activities. Malware authors abuse open source code and add their own stealer function to the main code." "We found a hardcoded connection detail stealer after deeper analysis. ![]() The only difference is that the malware version use 2.46.3-Unicode and the official installer use v2.45-Unicode, as shown: "The installed malware FTP client looks like the official version and it is fully functional! You can’t find any suspicious behavior, entries in the system registry, communication or changes in application GUI." Once installed, the software's appearance and functionalities are equal to the original version, so a user cannot distinguish between the fake or real one, and the malware version of the “.exe” file is just slightly smaller than the real one. ![]() The software is open source, but has been modified by the hackers that steal users' credentials, offered on various hacked sites for download with banner or text ads. Malware code can be very small, and the impact can be very severe! The Antivirus firm AVAST spotted a malicious version of the open source FTP (File Transfer Protocol) software 'FileZilla' out in the wild. Warning: Malicious version of FTP Software FileZilla stealing users' Credentials
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |