Fake FileZilla Download Uses DLL Hijacking to Target FTP Credentials
Summary
A fake site distributes a trojanized FileZilla 3.69.5 archive with a malicious version.dll that hijacks DLL search order, runs inside filezilla.exe, and can access saved FTP credentials. Analysis observed sandbox evasion and DoH/C2 activity.
Key points
- The trojanized portable archive adds a malicious version.dll; its timestamp differs from the other 917 files, which match the reported release date.
- Process Monitor showed Windows loading the DLL from the FileZilla folder, allowing its code to run inside filezilla.exe.
- The DLL checks for virtual machines and sandboxes; in some test environments it went dormant, while in others it attempted callbacks.
- The loader used DNS-over-HTTPS to resolve welcome.supp0v3[.]com and also attempted TCP connections to 95.216.51.236:31415.
- Behavioral analysis flagged possible credential harvesting, process injection, autorun changes, and file-encryption activity; the article notes some detections may reflect FileZilla’s legitimate behavior.
- Distribution used the lookalike filezilla-project[.]live domain. The article says this relies on users downloading and running a tampered archive, not a FileZilla vulnerability.
- Recommended checks include looking for version.dll in portable FileZilla folders, downloading only from the official project site, and investigating DoH traffic from non-browser processes.
Article Details
- Attack Vectors
- A trojanized FileZilla 3.69.5 portable archive was distributed through the lookalike domain filezilla-project[.]live; infection required a user to download, extract, and run it.
- The added version.dll was loaded into filezilla.exe through DLL search-order hijacking. The DLL also attempted to find version_original.dll, consistent with proxying behavior.
- The loader used DNS-over-HTTPS to resolve its C2 domain and also attempted persistent TCP callbacks to 95.216.51[.]236 on port 31415.
- The loader performed checks for virtual machines and sandboxes before executing its payload.
- Defensive Notes
- Download FileZilla only from the official project domain and verify the download hash against the value published there.
- Check FileZilla portable directories for an unexpected version.dll; the article says a legitimate portable distribution does not include it.
- Monitor DNS-over-HTTPS traffic from non-browser processes and investigate unexpected outbound connections to public DoH resolvers.
- Block the listed malicious domains and IP address at the network perimeter.
- Inspect archives for file timestamp anomalies before extracting and running applications.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | filezilla-project[.]live | Lookalike site identified as hosting the malicious FileZilla archive. |
| DOMAIN | welcome[.]supp0v3[.]com | C2 domain used for callback and staging. |
| IPV4 | 95[.]216[.]51[.]236 | C2 server contacted over TCP port 31415. |
| SHA256 | 665cca285680df321b63ad5106b167db9169afe30c17d349d80682837edcc755 | Hash of the trojanized FileZilla_3.69.5_win64.zip archive. |
| SHA256 | e4c6f8ee8c946c6bd7873274e6ed9e41dec97e05890fa99c73f4309b60fd3da4 | Hash of the trojanized version.dll contained in the archive. |
| URL | hxxps[:]//welcome[.]supp0v3[.]com/d/callback?utm_tag=tbs2&utm_source=dll | Callback URL embedded in the loader's runtime configuration. |
MITRE ATT&CK
T1038 · DLL Search Order HijackingThe article identifies DLL search-order hijacking: filezilla.exe loads the malicious version.dll from its application directory before checking the system folder.T1055 · Process InjectionAutomated behavioral analysis flagged creation of suspended processes and writing to other processes' memory.T1059 · Command and Scripting InterpreterAutomated behavioral analysis flagged runtime .NET compilation via csc.exe.T1071.001 · Web ProtocolsThe loader sent an HTTPS request to Cloudflare's public resolver to resolve its C2 domain using DNS-over-HTTPS.T1204.002 · Malicious FileInfection required a user to download and run the modified archive from an unofficial site.T1486 · Data Encrypted for ImpactAutomated behavioral analysis flagged multiple file-encryption API calls; the article presents data encryption as a potential capability.T1497 · Virtualization/Sandbox EvasionThe loader checked BIOS and system manufacturer information, probed VirtualBox registry keys, enumerated disk drives, and used evasive sleep loops.T1547.001 · Registry Run Keys / Startup FolderAutomated behavioral analysis flagged registry modifications described as consistent with autorun persistence.T1555 · Credentials from Password StoresBehavioral analysis flagged credential harvesting from local FTP client software; the article notes some detections could reflect FileZilla's legitimate credential-store access.T1574.001 · DLLThe malicious DLL searched for version_original.dll, which the article describes as a sign of DLL proxying; that renamed original was absent from the archive.