The stolen data goes to a server in Germany. 'The whole operation is very quick and quiet,' Avast wrote. The username, password, FTP server and port are encoded using a custom base64 algorithm and sent to the attacker's server, according to Avast. Inside the tampered FileZilla versions, Avast found code that steals log-in credentials for servers users are accessing. The icons, buttons and images are the same, and the malware version of the '.exe' file is just slightly smaller than the real one, Avast wrote on its blog. The security vendor Avast found that the modified versions are nearly identical to the legitimate application. The organization said it is difficult to prevent tainted versions of its software 'since the FileZilla Project promotes beneficial redistribution and modifications of FileZilla in the spirit of free open source software and the GNU General Public License.' 'We do not condone these actions and are taking measures to get the known offenders removed,' FileZilla said.

Filezilla ftp client malware