E4del and PINHOLE RATs Turn FTP Banners Into Dead Drops for Malware Commands

Cybersecurity researchers are calling attention to a new campaign that employs FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans (RATs) tracked as E4del and PINHOLE.

While threat actors are known to abuse legitimate services to point to additional command-and-control (C2) infrastructure and blend in with regular network traffic, the development marks the first time this unusual technique has been spotted in the wild.

An FTP banner is a welcome message or text string that an FTP server sends to a client immediately upon connection. The mechanism allows “malware stagers to fetch commands directly from the protocol’s initial response,” SOCRadar said in a technical report. The modus operandi was first highlighted by the MalwareHunterTeam early last month. 

However, it’s worth noting that the method is a lot less stealthy than traditional web-based DDRs, as security controls are likely to flag FTP connections to unknown servers as anomalous.

In one case, the attack chain involves using Spanish-language lures related to voucher claims to deceive unwitting users into executing a Windows Shortcut (LNK), which then retrieves the next-stage command from an FTP banner. The command connects to a WebDAV server to download and execute a DLL export via “rundll32.exe” using conhost.

This WebDAV-based approach has also been put to use in connection with a ClearFake campaign distributing WordlistLoader and Amatera Stealer using ClickFix lures, as recently highlighted by Microsoft and Gen Threat Labs. The threat cluster is known for compromising legitimate websites and then planting fake CAPTCHA lures that use ClickFix-style social engineering decoys to trick users into executing malicious commands.

According to SOCRadar, the FTP banner at “157.254.194[.]31:21” utilizes a multi-stage delivery chain that fetches a second FTP banner from “167.148.41[.]164:21,” which executes PowerShell to download, extract, and run a binary from a ZIP archive. The end goal of the attack is to deliver E4del, a Node.js-based RAT that’s embedded within a digitally signed Electron application masquerading as Discord.

E4del operates in “Active” mode within the first 20 seconds of receiving a command, after which it checks in with the server at random between 200 milliseconds and 2 seconds. Should no new tasking commands arrive within 20 to 40 seconds, it enters into a “Semi-Active” state, at which point the beaconing interval is lengthened to between 2 and 5 seconds.

After 40 seconds of no activity, the trojan switches to an “Inactive” mode that further reduces the frequency of the C2 server check-ins to anywhere between 5 and 9 seconds.

The second malware family to abuse FTP banner is PINHOLE, which is assessed to be more advanced and uses high-reputation platforms like Pinterest and SurveyMonkey as DDRs to obtain the C2 server details and proxy the communication through Cloudflare Workers.

“The FTP banner at ‘209.99.185[.]38:21’ was found to contain commands that utilize the MSXML2.XMLHTTP COM object within PowerShell to retrieve a secondary command script from hxxps[://]cloudflare.milicare[.]in/app/c,” SOCRadar explained. “This script is saved as %TEMP%u.cmd, executed, and subsequently deleted to minimize the forensic footprint.”

The script is a dropper for unpacking and launching the main payload, the first stage of which is a wrapper that claims to be an update utility from a non-existent company named Weston Computing Systems Ltd. The binary employs the Halo’s Gate technique to bypass security software, while a successful C2 resolution allows the malware to query the domain for a next-stage payload.

The payload is subsequently handed off to an Early Bird APC Injection routine to run it inside a legitimate, suspended process, but not before proceeding through six layers of unpacking to extract the 119 KB native x86-64 PE executable. In doing so, the idea is to evade detection by security programs installed on the compromised host.

“This sophisticated strategy builds upon the traditional APC Injection method, creating a child process in a suspended state and injecting shellcode that is later executed via asynchronous procedure calls (APCs),” KPMG Israel notes in an explainer. “This nuanced approach allows the malware to evade conventional antivirus (AV) and endpoint detection and response (EDR) systems, which are typically tuned to recognize more straightforward shellcode patterns.”

The final injected executable contains the RAT functionality of PINHOLE, which entails communicating with the C2 server over HTTP GET and POST requests to poll for commands and send the results back, download or upload files, and retrieve an as-yet-undetermined browser stealer module.

PINHOLE RAT features 14 commands to enumerate files and directories, exfiltrate files, execute a payload or binary, recursively search for files, delete specific files, list running processes, terminate a process by PID, take screenshots, run PowerShell commands, and initialize a PowerShell session using anonymous pipes.

The attackers behind PINHOLE have also been found to maintain a dedicated “FTP Stats Panel” at “69.48.228[.]126:5000” that allows them to monitor the success rate of their campaigns by keeping tabs on the number of script executions, total connections, and unique active or blocked IP addresses interacting with their FTP infrastructure. At the time of analysis, the panel had only 11 execution events, suggesting the campaign was still in its infancy.

“The identification of FTP banners as DDRs presents a creative, albeit less stealthy, evolution in malware delivery, allowing threat actors to embed malicious commands directly within the protocol’s banner,” SOCRadar said. “Although initial access methods point to shortcut-file phishing, attackers could easily adapt FTP banner abuse for ClickFix campaigns as well.”