[Blink]

A user of FileZilla was wondering why the installer did so terribly in a VirusTotal scan (https://www.virustotal.com/en/file/d93fd.../analysis/)
The creator, botg, responded saying that the scans returned false positives.
Another user later responded noting that the hash of the file didn't match the one on the site, to which botg responded with:

The hash doesn't match because the filename doesn't match.

After this, the thread continues with botg defending FileZilla in other ridiculous ways:

You get AV flags for business reasons on the AV vendor's behalf, not because of malware.

Although not necessarily malicious, botg's behavior seems sketchy at best.

Reddit thread: https://www.reddit.com/r/netsec/comments...a_malware/
Here's the original thread on the FileZilla support forum: https://forum.filezilla-project.org/view...c&start=15
VirusTotal (again): https://www.virustotal.com/en/file/d93fd.../analysis/
AlternativeTo has also recently flagged FileZilla as "may not be safe"


For alternatives, try Cyberduck (https://cyberduck.io/) or WinSCP (https://winscp.net/eng/index.php)


If you do end up deciding that FileZilla is safe, you may want to compile it from source (https://filezilla-project.org/sourcecode.php) instead of using the binary installer.

UPDATE: It seems to distribute adware, and uses a shady installer, but is not necessarily malware. See here: https://sinister.ly/Thread-FileZilla-all...#pid813756

[phyrrus9]

tldr: filezilla did some shady stuff. that's all this thread says. @"Ender" should clarify more

[Blink]

tldr: filezilla did some shady stuff. that's all this thread says. @"Ender" should clarify more

Clarify what?

[Vultra]

Do we know exactly what type of malware it is?

[Percent]

That's why everybody advises people to compile from the source, as compared to just downloading the seemingly trustworthy binaries.

[mothered]

This has made my day, absolutely hilarious:

The hash doesn't match because the filename doesn't match

Appreciate the Info @"Ender".

[Blink]

Do we know exactly what type of malware it is?

After reading into it more (seeing what VT actually reports), it seems be a shady installer; thus, botg was not entirely incorrect. It appears to use InstallCore, or FusionCore for the installation, you can read up on that here: https://www.microsoft.com/en-us/wdsi/thr...nstallCore

Therefore, FileZilla would not be considered straight malware, but simply riskware, as it uses an installer that distributes adware and has a low reputation. I'll update the original post with this information. However, even with this information, I would recommend that you avoid using it, and use an alternative instead.

[Bionic]

It's not the first time filezilla bundled malware. They were one of the voluntary partners of sourceforge's bundled installer before they pushed it on everyone and then got rid of it after they got bought out.

[Vultra]

Well, I'm now using WinSCP and works sufficiently well.

[darkninja1980]

very interesting news. thank you OP for sharing.