E4del and PINHOLE RATs Use FTP Banners as Novel Dead Drop Resolvers
Two new remote access trojans, E4del and PINHOLE, are employing a novel technique using FTP banners as dead drop resolvers to hide command and control infrastructure.
Cybersecurity researchers have uncovered a novel campaign utilizing FTP banners as dead drop resolvers (DDRs) to distribute two previously unknown remote access trojans (RATs) named E4del and PINHOLE. This technique represents a new method for threat actors to obscure their command and control (C2) infrastructure by embedding malicious URLs within the welcome messages that FTP servers send to clients upon connection.
While threat actors commonly abuse legitimate services to mask their C2 servers and blend in with normal network traffic, this specific use of FTP banners is a first in the wild. The mechanism allows malware "stagers to fetch commands directly from the protocol's initial response," according to a technical report by SOCRadar. Although this method is less stealthy than traditional web-based DDRs, as security controls are more likely to flag unusual FTP connections, it demonstrates an evolving tactic to evade detection.
One observed attack chain begins with Spanish-language lures related to voucher claims, designed to trick unsuspecting users into executing a Windows Shortcut (LNK) file. This LNK file then retrieves the next-stage command from an FTP banner. The subsequent command connects to a WebDAV server to download and execute a DLL via rundll32.exe using conhost. This WebDAV approach has also been linked to ClearFake campaigns, which distribute malware like WordlistLoader and Amatera Stealer using social engineering lures that mimic CAPTCHA prompts.
The FTP banner at 157.254.194[.]31:21 initiates a multi-stage delivery chain. It fetches a second FTP banner from 167.148.41[.]164:21, which then executes PowerShell to download, extract, and run a binary from a ZIP archive. The ultimate objective is to deploy E4del, a RAT built with Node.js and embedded within a digitally signed Electron application that masquerades as Discord. E4del offers capabilities such as defense evasion, persistence, system fingerprinting, and encrypted C2 communication.
E4del's C2 communication mechanism is highly dynamic, employing a tiered jitter system to mimic normal network traffic. The RAT transitions between "Active," "Semi-Active," and "Inactive" states based on the time elapsed since its last received task. In "Active" mode, it beacons within milliseconds to a few seconds. This interval extends to several seconds in "Semi-Active" and "Inactive" modes, further helping it blend in with legitimate network activity.
The second malware family, PINHOLE, is considered more advanced and leverages high-reputation platforms like Pinterest and SurveyMonkey as DDRs. It obtains C2 server details and proxies communication through Cloudflare Workers. The FTP banner at 209.99.185[.]38:21 contains commands that use the MSXML2.XMLHTTP COM object within PowerShell to retrieve a secondary command script from hxxps[://]cloudflare.milicare[.]in/app/c.
This script is saved as %TEMP%u.cmd, executed, and then deleted to minimize its forensic footprint. It acts as a dropper for the main payload, which begins with a wrapper claiming to be an update utility from a fictional company. The binary uses the Halo's Gate technique to bypass security software. Upon successful C2 resolution, the malware queries the domain for a next-stage payload, which is then handed off to an Early Bird APC Injection routine to run within a legitimate, suspended process after passing through six layers of unpacking.
PINHOLE RAT communicates with its C2 server over HTTP GET and POST requests, polling for commands, sending results, downloading/uploading files, and potentially retrieving a browser stealer module. It features 14 commands for various actions, including file enumeration, exfiltration, payload execution, process management, and screenshot capture. The attackers behind PINHOLE also maintain an "FTP Stats Panel" to monitor campaign success rates, tracking script executions, total connections, and unique IP addresses interacting with their FTP infrastructure.