E4del and PINHOLE abuse FTP banners to deliver RAT commands
Security researchers have identified campaigns delivering two previously unreported remote access trojans, E4del and PINHOLE, through commands embedded in FTP server banners. SOCRadar described the method as the first observed in-the-wild use of FTP banners as dead drop resolvers, allowing malware stagers to collect instructions from the protocol’s initial response after connecting to a server.
An FTP banner is the welcome text returned when a client connects to an FTP server. Threat actors have long used legitimate services to direct victims towards command-and-control infrastructure, but this approach places a command directly in the banner. SOCRadar noted that the technique is less stealthy than web-based dead drop resolvers because connections to unfamiliar FTP servers can stand out to security controls.
Two delivery chains, two RAT families
One observed chain uses Spanish-language voucher-claim lures to persuade targets to run a Windows Shortcut file. The LNK retrieves a next-stage command from an FTP banner, which connects to a WebDAV server and downloads a DLL for execution through rundll32.exe using conhost. A banner at 157.254.194[.]31:21 was reported to lead to a second banner at 167.148.41[.]164:21, which launches PowerShell to download, extract and run a binary from a ZIP archive.
The intended payload in that chain is E4del, a Node.js-based RAT embedded in a digitally signed Electron application masquerading as Discord. Its documented functions include persistence, defence evasion, system fingerprinting, encrypted command-and-control communications, reverse-shell access, screenshots, live desktop streaming, file download and delivery of further payloads.
SOCRadar said E4del changes its beaconing behaviour based on the time since the last task. In Active mode, during the first 20 seconds after a command, it checks in at random intervals from 200 milliseconds to two seconds. After 20 to 40 seconds without new tasking, the Semi-Active interval moves to two to five seconds. After 40 seconds, Inactive mode checks in every five to nine seconds.
PINHOLE adds layered evasion
PINHOLE uses high-reputation platforms including Pinterest and SurveyMonkey as dead drop resolvers and proxies communications through Cloudflare Workers. SOCRadar found an FTP banner at 209.99.185[.]38:21 containing PowerShell commands that use the MSXML2.XMLHTTP COM object to retrieve a secondary script. The script is stored as %TEMP%u.cmd, executed and then deleted.
Its loader presents itself as an update utility for the non-existent Weston Computing Systems Ltd. The malware uses Halo’s Gate, then moves through six unpacking layers before an Early Bird APC Injection routine runs a 119 KB native x86-64 PE executable inside a legitimate suspended process. The final PINHOLE RAT communicates over HTTP GET and POST, supports file transfers and screenshots, and has 14 commands for actions including file enumeration, process management and PowerShell execution.
The operators also maintained an FTP Stats Panel tracking script executions, connections and active or blocked IP addresses. At the time of analysis it showed 11 execution events, indicating an early-stage campaign. For businesses, the practical response is to investigate unexpected outbound FTP traffic alongside LNK phishing, PowerShell, WebDAV and rundll32 activity, rather than treating an FTP banner as harmless connection text.