To protect yourself against this riskware, don’t use FileZilla.

Many of these applications may not be detected by antivirus software. The wrapper contains potentially unwanted application / potentially unwanted program ( PUA/PUP) (e.g., possibly fusioncore, installcore, Eldorado) and riskware. The download from this link delivers a bundled installation wrapper (a program used to execute one or more other installation program). How does the riskware get installed on your computer?Ī pop-up link alerts the user their FileZilla application is out of date and directs the user to the website for.

This can be an indication of malicious behavior, such as command and control traffic. While using FileZilla, users observed a process that reaches out to random, unrelated IP Addresses over TCP/80. These files may contain data in binary or text format, and typically they are accessed only by the application that created them. Many programs create, open, or reference dat files. For example, it allows for comparison and file synchronizing, as well as tab browsing between servers, transferring files to multiple servers simultaneously, and editing remote files on the go.įileZilla users observed the “complete” FileZilla installer creating an unidentified process which spawns multiple command line prompts that append dat files (a generic data file) together. FileZilla’s tools allow the user to manage and transfer files between their local machine and a remote server. It is still possible to download the un-bundled version, but this introduces an extra level of complexity to the end user that can be avoided by recommending other SFTP options.įileZilla is a cross-platform graphical File Transfer Protocol (FTP), Secure File Transfer Protocol (SFTP), and FTP Secure (FTPS) file management tool for Windows, Linux, Mac OS X, and other operating systems. Note that the behavior exhibited by FileZilla refers to the “bundled” version of the program (which is the default download version).

While we do not consider the behavior to rise to the level of malware, it does have the potential to pose a risk. The Office of the CISO recently learned of suspicious processes created by the FileZilla SFTP program.

Amahi and filezilla sftp