The software is open source, but has been modified by the hackers that
steal users' credentials, offered on various hacked sites for download
with banner or text ads.
Once installed, the software's appearance and functionalities are equal
to the original version, so a user cannot distinguish between the fake
or real one, and the malware version of the “.exe” file is just slightly smaller than the real one.
"The installed malware FTP client looks like the official version and
it is fully functional! You can’t find any suspicious behavior, entries
in the system registry, communication or changes in application GUI."
The only difference is that the malware version use 2.46.3-Unicode and the official installer use v2.45-Unicode, as shown:
"We found a hardcoded connection detail stealer after deeper
analysis. Malware authors abuse open source code and add their own
stealer function to the main code."
The modified version copies the login information of the user and sends it to a server that is apparently in Germany, and same IP address of the server hosts three other domains, which are also associated with malware and spam activities.
The modified version copies the login information of the user and sends it to a server that is apparently in Germany, and same IP address of the server hosts three other domains, which are also associated with malware and spam activities.
"Login details are sent to attackers from the ongoing FTP connection only once. Malware doesn't search bookmarks or send any other files or saved connections," Avast explains.
Be Careful when downloading the FileZilla FTP client, such
malware could also be employed for spreading more malware. Users are
recommended to downloaded the softwares from the official website only.
