download:

/server/FileZilla_Server_1.8.2_win64-setup.exe

Full analysis: https://app.any.run/tasks/48f1e36a-78cc-4889-99b3-84f9fe6060b3
Verdict: Malicious activity
Analysis date: June 25, 2024, 21:55:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

7BEFF4DF148380D439031034197342DE

SHA1:

B6F5FB300DCF250C6EBB9479BB1A60FBD212D04E

SHA256:

578720DDB1F9B0A25367933459A75D3EF5CEDB720FA30FB6F23766C165740769

SSDEEP:

98304:i1T3ZM8An9/+G+z4c6330/A54l8/iL4SyUi27MrXJ/rFzVsn/YgaJxPH2cQDXDnr:AuOWCWpMkm8Kh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Changes the autorun value in the registry

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • The process creates files with name similar to system file names

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Starts application with an unusual extension

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Creates a software uninstall entry

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Starts SC.EXE for service management

      • ns7327.tmp (PID: 400)

    • Executable content was dropped or overwritten

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

  • INFO

    • Create files in a temporary directory

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Checks supported languages

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)
      • ns7327.tmp (PID: 400)

    • Reads the computer name

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Creates files in the program directory

      • FileZilla_Server_1.8.2_win64-setup.exe (PID: 3220)

    • Manual execution by a user

      • explorer.exe (PID: 740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:43+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 139776
UninitializedDataSize: 2048
EntryPoint: 0x3645
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.8.2.0
ProductVersionNumber: 1.8.2.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Tim Kosse <tim.kosse@filezilla-project.org>
FileDescription: FileZilla Server
FileVersion: 1.8.2
LegalCopyright: Tim Kosse <tim.kosse@filezilla-project.org>
OriginalFileName: FileZilla_Server_1.8.2_win64-setup.exe
ProductName: FileZilla Server
ProductVersion: 1.8.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start filezilla_server_1.8.2_win64-setup.exe ns7327.tmp no specs sc.exe no specs explorer.exe no specs Shell Security Editor no specs filezilla_server_1.8.2_win64-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
400"C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\ns7327.tmp" C:\Windows\system32\sc start "filezilla-server" --config-version-check error --config-version-check-result-file "C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\config-version-check-result.txt" --config-dir-ownership-check-result-file "C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\config-dir-ownership-check-result.txt"C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\ns7327.tmp—FileZilla_Server_1.8.2_win64-setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
216
Modules
Images
c:\users\admin\appdata\local\temp\nsje78f.tmp\ns7327.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
740"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2948C:\Windows\system32\sc start "filezilla-server" --config-version-check error --config-version-check-result-file "C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\config-version-check-result.txt" --config-dir-ownership-check-result-file "C:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\config-dir-ownership-check-result.txt"C:\Windows\System32\sc.exe—ns7327.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
216
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3220"C:\Users\admin\AppData\Local\Temp\FileZilla_Server_1.8.2_win64-setup.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_Server_1.8.2_win64-setup.exe
explorer.exe
User:
admin
Company:
Tim Kosse <tim.kosse@filezilla-project.org>
Integrity Level:
HIGH
Description:
FileZilla Server
Version:
1.8.2
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_server_1.8.2_win64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3368"C:\Users\admin\AppData\Local\Temp\FileZilla_Server_1.8.2_win64-setup.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_Server_1.8.2_win64-setup.exe—explorer.exe
User:
admin
Company:
Tim Kosse <tim.kosse@filezilla-project.org>
Integrity Level:
MEDIUM
Description:
FileZilla Server
Exit code:
3221226540
Version:
1.8.2
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_server_1.8.2_win64-setup.exe
c:\windows\system32\ntdll.dll
4064C:\Windows\system32\DllHost.exe /Processid:{4D111E08-CBF7-4F12-A926-2C7920AF52FC}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 715
Read events
2 685
Write events
30
Delete events
0

Modification events

(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:UninstallString
Value:
"C:\Program Files\FileZilla Server\Uninstall.exe"
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:InstallLocation
Value:
C:\Program Files\FileZilla Server
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:DisplayName
Value:
FileZilla Server 1.8.2
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:DisplayIcon
Value:
C:\Program Files\FileZilla Server\filezilla-server.exe
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:DisplayVersion
Value:
1.8.2
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:URLInfoAbout
Value:
https://filezilla-project.org/
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:URLUpdateInfo
Value:
https://filezilla-project.org/
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:HelpLink
Value:
https://filezilla-project.org/
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:Publisher
Value:
Tim Kosse <tim.kosse@filezilla-project.org>
(PID) Process:(3220) FileZilla_Server_1.8.2_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FileZilla Server
Operation:writeName:VersionMajor
Value:
1
Executable files
23
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\libstdc++-6.dllexecutable
MD5:BB65AE221D1EBBFE4A98727C74D5A700
SHA256:171D62525A1B9C068D5EEEE31432FA5814F1CE9FBF6C2CABD9F8C0F28F6B1F7C
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\System.dllexecutable
MD5:4ADD245D4BA34B04F213409BFE504C07
SHA256:9111099EFE9D5C9B391DC132B2FAF0A3851A760D4106D5368E30AC744EB42706
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsjE78F.tmp\StartMenu.dllexecutable
MD5:A8C86996C4230C2209F5927F21321377
SHA256:110545415A59402635E1C9439ACBA15B44BAB268ED02AD2A262CE12604A47855
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\NEWStext
MD5:DD644283E2A931EAD6ED9B29F1BC8D47
SHA256:A7247F6046C9E8CB57D37B9D754AC8A8BA6571E2F4C92C9AF83612D37B218CDC
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\libgcc_s_seh-1.dllexecutable
MD5:873DA6535C2521217D221DAC3EFFCB8A
SHA256:231C9D211F092570F48CCAF40A31C2CB5FC038EEF5AF8B430ADBF0FBF7385E16
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\libfilezilla-43.dllexecutable
MD5:420582CDD01E3324E56F444F56413817
SHA256:DBA3EBFC241BBB49418498CD71392B6546B7E25AA7F7131AA3531DC6C6FEE50E
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\libpng16-16.dllexecutable
MD5:77D6D7821D73FDB09EE13787A27DF723
SHA256:DAA7C94D516064A6C18664C47567E6EAE962ACD8F6C000F6500015C55EBFEEE8
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\filezilla-server-config-converter.exeexecutable
MD5:98E80DCF6B00C0E1D048055180E77CA3
SHA256:81953AC483A5C904DC6D8A8F924BDCB326E46A6D5F25BF41A7F90B288785B9F7
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\libhogweed-6.dllexecutable
MD5:AE4F143DA5715750BA6F2177CE1E7CB6
SHA256:B6DFE30925741CDB137F6AF4ED0C9576C48E70E1B9B588E62F7CC9BC695B5830
3220FileZilla_Server_1.8.2_win64-setup.exeC:\Program Files\FileZilla Server\libgnutls-30.dllexecutable
MD5:9E55468AFB55210ED4F96059D9D4C7EE
SHA256:F468C8A03D361B077E60D407B6C4F06A6336CA5B5C46F8B928BADE8D5B8290F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
11
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
1060
svchost.exe
GET
304
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a9f83325acc8ca75
unknown
—
—
unknown
1372
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1372
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
239.255.255.250:3702
—
—
—
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1372
svchost.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown
1372
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
1060
svchost.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
ctldl.windowsupdate.com
  • 87.248.204.0
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/server/FileZilla_Server_1.8.2_win64-setup.exe