download:

/server/FileZilla_Server_1.8.2_win64-setup.exe

Full analysis: https://app.any.run/tasks/48f1e36a-78cc-4889-99b3-84f9fe6060b3
Verdict: Malicious activity
Analysis date: June 25, 2024, 21:55:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

7BEFF4DF148380D439031034197342DE

SHA1:

B6F5FB300DCF250C6EBB9479BB1A60FBD212D04E

SHA256:

578720DDB1F9B0A25367933459A75D3EF5CEDB720FA30FB6F23766C165740769

SSDEEP:

98304:i1T3ZM8An9/+G+z4c6330/A54l8/iL4SyUi27MrXJ/rFzVsn/YgaJxPH2cQDXDnr:AuOWCWpMkm8Kh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Changes the autorun value in the registry

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • The process creates files with name similar to system file names

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Starts application with an unusual extension

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Creates a software uninstall entry

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Executable content was dropped or overwritten

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Starts SC.EXE for service management

      • ns7327.tmp (PID: 400)

  • INFO

    • Checks supported languages

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)
      • ns7327.tmp (PID: 400)

    • Reads the computer name

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Creates files in the program directory

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Create files in a temporary directory

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Manual execution by a user

      • explorer.exe (PID: 740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:43+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 139776
UninitializedDataSize: 2048
EntryPoint: 0x3645
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.8.2.0
ProductVersionNumber: 1.8.2.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Tim Kosse <tim.kosse@filezilla-project.org>
FileDescription: FileZilla Server
FileVersion: 1.8.2
LegalCopyright: Tim Kosse <tim.kosse@filezilla-project.org>
OriginalFileName: FileZilla_Server_1.8.2_win64-setup.exe
ProductName: FileZilla Server
ProductVersion: 1.8.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start filezilla_server_1.8.2_win64-setup.exe ns7327.tmp no specs sc.exe no specs explorer.exe no specs Shell Security Editor no specs filezilla_server_1.8.2_win64-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
400"C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\ns7327.tmp" C:\Windows\system32\sc start "filezilla-server" --config-version-check error --config-version-check-result-file "C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\config-version-check-result.txt" --config-dir-ownership-check-result-file "C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\config-dir-ownership-check-result.txt"C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\ns7327.tmp—FileZilla_Server_1.8.2_win64-setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
216
Modules
Images
c:\users\admin\appdata\local\temp\nsje78f.tmp\ns7327.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
740"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2948C:\Windows\system32\sc start "filezilla-server" --config-version-check error --config-version-check-result-file "C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\config-version-check-result.txt" --config-dir-ownership-check-result-file "C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\config-dir-ownership-check-result.txt"C:\Windows\System32\sc.exe—ns7327.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
216
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3220"C:\Users\admin\AppData\Local\Temp\FileZilla_Server_1.8.2_win64-setup.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_Server_1.8.2_win64-setup.exe
explorer.exe
User:
admin
Company:
Tim Kosse <tim.kosse@filezilla-project.org>
Integrity Level:
HIGH
Description:
FileZilla Server
Version:
1.8.2
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_server_1.8.2_win64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3368"C:\Users\admin\AppData\Local\Temp\FileZilla_Server_1.8.2_win64-setup.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_Server_1.8.2_win64-setup.exe—explorer.exe
User:
admin
Company:
Tim Kosse <tim.kosse@filezilla-project.org>
Integrity Level:
MEDIUM
Description:
FileZilla Server
Exit code:
3221226540
Version:
1.8.2
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_server_1.8.2_win64-setup.exe
c:\windows\system32\ntdll.dll
4064C:\Windows\system32\DllHost.exe /Processid:{4D111E08-CBF7-4F12-A926-2C7920AF52FC}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 715
Read events
2 685
Write events
30
Delete events
0

Modification events

(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:UninstallString
Value:
"C:\Program Files\FileZilla Server\Uninstall.exe"
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:InstallLocation
Value:
C:\Program Files\FileZilla Server
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:DisplayName
Value:
FileZilla Server 1.8.2
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:DisplayIcon
Value:
C:\Program Files\FileZilla Server\filezilla-server.exe
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:DisplayVersion
Value:
1.8.2
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:URLInfoAbout
Value:
https://filezilla-project.org/
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:URLUpdateInfo
Value:
https://filezilla-project.org/
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:HelpLink
Value:
https://filezilla-project.org/
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:Publisher
Value:
Tim Kosse <tim.kosse@filezilla-project.org>
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:VersionMajor
Value:
1
Executable files
23
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\System.dllexecutable
MD5:4ADD245D4BA34B04F213409BFE504C07
SHA256:9111099EFE9D5C9B391DC132B2FAF0A3851A760D4106D5368E30AC744EB42706
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\Uninstall.exeexecutable
MD5:0B6279086A431DA719A5AED13E73BD11
SHA256:6D201E5DC290E4140C5839C41D95FD12DE2D9B585C3BF5D1354DBC7477FD7754
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\libgcc_s_seh-1.dllexecutable
MD5:873DA6535C2521217D221DAC3EFFCB8A
SHA256:231C9D211F092570F48CCAF40A31C2CB5FC038EEF5AF8B430ADBF0FBF7385E16
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\libgmp-10.dllexecutable
MD5:2542F0D7E2425DBE26175892BC3F25B6
SHA256:7613AA91D1926636CF717522B367BEA6C3A549C329E4FF5D021E9103BBBED75B
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\NEWStext
MD5:DD644283E2A931EAD6ED9B29F1BC8D47
SHA256:A7247F6046C9E8CB57D37B9D754AC8A8BA6571E2F4C92C9AF83612D37B218CDC
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\filezilla-server-impersonator.exeexecutable
MD5:D154E643A24F3588E678E331EBA999C3
SHA256:7EFB42640A00477964EF23AF6413197701933DB554BF0293CB15D18476F826FD
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\filezilla-server-config-converter.exeexecutable
MD5:98E80DCF6B00C0E1D048055180E77CA3
SHA256:81953AC483A5C904DC6D8A8F924BDCB326E46A6D5F25BF41A7F90B288785B9F7
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\filezilla-server-gui.exeexecutable
MD5:D06F9CDE324E2A609BC8687485BAA895
SHA256:88AD8DF96537B6091675E69039B14DC0D7EF9AEEA6B5DA16AAF075611DC7B24E
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\wxbase32u_gcc_custom.dllexecutable
MD5:1F9B2BF219EA441723C74DB2ABDB9B31
SHA256:1BCBBA924B04DFF11F5D01D2D8C566A3C2DC7DE7E32F819DA23DF8A4A2E1B73C
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\COPYINGtext
MD5:EB1E647870ADD0502F8F010B19DE32AF
SHA256:0D96A4FF68AD6D4B6F1F30F713B18D5184912BA8DD389F86AA7710DB079ABCB0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
11
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
1372
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
1060
svchost.exe
GET
304
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a9f83325acc8ca75
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1372
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
239.255.255.250:3702
—
—
—
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1372
svchost.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
1372
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
1060
svchost.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
ctldl.windowsupdate.com
  • 87.248.204.0
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/server/FileZilla_Server_1.8.2_win64-setup.exe