File name:

FileZilla_3.69.1_win64-setup.exe

Full analysis: https://app.any.run/tasks/8529fdee-4f10-42ee-9544-1d7d04fa2b4b
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: June 18, 2025, 11:49:51
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xred
backdoor
delphi
dyndns
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

403E7C97A99B983AC86AA46AA5503693

SHA1:

BA5DE2D0611369837709D05E1EE9D9F408E36C97

SHA256:

DA874D5326B66F55A35BC65BF7E8400150204EA77981E6D2895D50A697262703

SSDEEP:

98304:Yr7ayGJ6kHOS6lcvAFrOi5D5GmGRud3CrkaLft9mDuShL2IjV4F7AOhea+sJ8f+0:2a7U/JljyjSvByyzeAFjrhMI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • ._cache_FileZilla_3.69.1_win64-setup.exe (PID: 2664)

    • XRED mutex has been found

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)
      • Synaptics.exe (PID: 3980)

    • Changes the autorun value in the registry

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)

    • XRED has been detected (YARA)

      • Synaptics.exe (PID: 3980)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)
      • Synaptics.exe (PID: 3980)

    • Executable content was dropped or overwritten

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)
      • ._cache_FileZilla_3.69.1_win64-setup.exe (PID: 2664)

    • The process creates files with name similar to system file names

      • ._cache_FileZilla_3.69.1_win64-setup.exe (PID: 2664)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • ._cache_FileZilla_3.69.1_win64-setup.exe (PID: 2664)

    • There is functionality for taking screenshot (YARA)

      • ._cache_FileZilla_3.69.1_win64-setup.exe (PID: 2664)
      • Synaptics.exe (PID: 3980)

    • There is functionality for communication over UDP network (YARA)

      • Synaptics.exe (PID: 3980)

    • There is functionality for communication dyndns network (YARA)

      • Synaptics.exe (PID: 3980)

  • INFO

    • Reads the computer name

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)
      • ._cache_FileZilla_3.69.1_win64-setup.exe (PID: 2664)
      • Synaptics.exe (PID: 3980)

    • Checks supported languages

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)
      • ._cache_FileZilla_3.69.1_win64-setup.exe (PID: 2664)
      • Synaptics.exe (PID: 3980)

    • The sample compiled with chinese language support

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)

    • Create files in a temporary directory

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)
      • ._cache_FileZilla_3.69.1_win64-setup.exe (PID: 2664)

    • Process checks computer location settings

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)

    • The sample compiled with english language support

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)

    • FileZilla executable

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)

    • Creates files in the program directory

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)
      • Synaptics.exe (PID: 3980)

    • Launching a file from a Registry key

      • FileZilla_3.69.1_win64-setup.exe (PID: 6104)

    • Reads the software policy settings

      • Synaptics.exe (PID: 3980)

    • Checks proxy server information

      • Synaptics.exe (PID: 3980)

    • Compiled with Borland Delphi (YARA)

      • ._cache_FileZilla_3.69.1_win64-setup.exe (PID: 2664)
      • Synaptics.exe (PID: 3980)

    • Reads the machine GUID from the registry

      • Synaptics.exe (PID: 3980)

    • Creates files or folders in the user directory

      • Synaptics.exe (PID: 3980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (90.7)
.exe | InstallShield setup (5.8)
.exe | Win32 Executable Delphi generic (1.9)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 629760
InitializedDataSize: 12564480
UninitializedDataSize: -
EntryPoint: 0x9ab80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 1.0.0.0
FileDescription: 易语言程序
ProductName: 易语言程序
ProductVersion: 1.0.0.0
LegalCopyright: 作者版权所有 请尊重并使用正版
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XRED filezilla_3.69.1_win64-setup.exe ._cache_filezilla_3.69.1_win64-setup.exe #XRED synaptics.exe svchost.exe slui.exe no specs filezilla_3.69.1_win64-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2664"C:\Users\admin\AppData\Local\Temp\._cache_FileZilla_3.69.1_win64-setup.exe" C:\Users\admin\AppData\Local\Temp\._cache_FileZilla_3.69.1_win64-setup.exe
FileZilla_3.69.1_win64-setup.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Version:
3.69.1
Modules
Images
c:\users\admin\appdata\local\temp\._cache_filezilla_3.69.1_win64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
3788C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3980"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateC:\ProgramData\Synaptics\Synaptics.exe
FileZilla_3.69.1_win64-setup.exe
User:
admin
Integrity Level:
HIGH
Description:
易语言程序
Version:
1.0.0.0
Modules
Images
c:\programdata\synaptics\synaptics.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6104"C:\Users\admin\AppData\Local\Temp\FileZilla_3.69.1_win64-setup.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_3.69.1_win64-setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
易语言程序
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_3.69.1_win64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6620"C:\Users\admin\AppData\Local\Temp\FileZilla_3.69.1_win64-setup.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_3.69.1_win64-setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
易语言程序
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_3.69.1_win64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
2 288
Read events
2 286
Write events
2
Delete events
0

Modification events

(PID) Process:(6104) FileZilla_3.69.1_win64-setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6104) FileZilla_3.69.1_win64-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:?????
Value:
C:\ProgramData\Synaptics\Synaptics.exe
Executable files
7
Suspicious files
6
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6104FileZilla_3.69.1_win64-setup.exeC:\Users\admin\AppData\Local\Temp\._cache_FileZilla_3.69.1_win64-setup.exeexecutable
MD5:832FC7D6516129D85844BE73B1E65F90
SHA256:6CBD5FDB157A7851CDD32B9A61D6136A31A5FA05FB36FD9403B920B708C9125E
2664._cache_FileZilla_3.69.1_win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsx6265.tmp\UserInfo.dllexecutable
MD5:E6F30908ABFC6F53B7C3C36DAEC4586D
SHA256:E0DC3112796DBAA37F25AB54B7FAC2FBF791CBC6E36A84FC61C6423B84A3677B
2664._cache_FileZilla_3.69.1_win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsx6265.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
3980Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
3980Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4192284F64D05C3128BDDF2B3478F250
SHA256:28F669488C541AB5DB4A701DAD502E6BC9D055C2875BB74028BD58C5A34B2CAF
3980Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:F90461188A7797CE098D300777B6B6B3
SHA256:10D61BC12877B1725B2D0B2039DB253AAD77BF092260DBD6153C2811A2366166
3980Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C60C0C29522E01E6A22BD2717F20782E_927CD7694ABAB4DA64EA66E7743CA0D9binary
MD5:F3984A7543BBF010CB988E8B85B6C493
SHA256:FCA77D5CD0751F06340EDF1BC13D94DBB065D9F8676B16934A53FF2890408D31
3980Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
3980Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C60C0C29522E01E6A22BD2717F20782E_927CD7694ABAB4DA64EA66E7743CA0D9binary
MD5:B1B7225469D3B8737CFB2CF0A3F67528
SHA256:05262743A54BAD0EDE9C480DE63EB69A5557DF7BA95ACEE78FC0330238B4E923
2664._cache_FileZilla_3.69.1_win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsx6265.tmp\System.dllexecutable
MD5:9B38A1B07A0EBC5C7E59E63346ECC2DB
SHA256:C881253DAFCF1322A771139B1A429EC1E78C507CA81A218A20DC1A4B25ABBFE7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
40
DNS requests
22
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3980
Synaptics.exe
GET
200
69.42.215.252:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
unknown
—
—
whitelisted
2632
svchost.exe
GET
200
23.50.108.3:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.17.245.133:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1080
SIHClient.exe
GET
200
2.17.245.133:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1080
SIHClient.exe
GET
200
2.17.245.133:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5328
SearchApp.exe
GET
200
23.50.108.3:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5328
SearchApp.exe
GET
200
23.50.108.3:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4960
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3980
Synaptics.exe
69.42.215.252:80
freedns.afraid.org
AWKNET
US
whitelisted
2200
svchost.exe
224.0.0.251:5353
—
—
—
unknown
2200
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2632
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
xred.mooo.com
  • —
whitelisted
freedns.afraid.org
  • 69.42.215.252
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.5
  • 20.190.160.17
  • 40.126.32.136
  • 20.190.160.3
  • 20.190.160.131
  • 40.126.32.138
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 23.50.108.3
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 2.17.245.133
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.22
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to Abused Domain *.mooo.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FileZilla_3.69.1_win64-setup.exe