Skip to content

E4del and PINHOLE RATs use FTP banners as dead drop resolvers

Summary

SOCRadar (via The Hacker News, August 25, 2026) documented the first in-the-wild campaign to use FTP banners as dead drop resolvers (DDRs): malware stagers fetch the next-stage command directly from the FTP server's initial connection response (banner) instead of from web pages. The technique — MITRE T1102.001 (Non-Standard Port) / protocol-response exfil-adjacent DDR primitive — delivers two previously unreported RATs, E4del and PINHOLE. The modus operandi was first highlighted by MalwareHunterTeam in early July 2026. SOCRadar notes the method is less stealthy than web-based DDRs: FTP connections to unknown servers are typically flagged as anomalous by network controls, but it still blends into legitimate service abuse.

Tags

E4del chain (Node.js / Electron Discord masquerade)

  • Lure: Spanish-language voucher-claim pages; victim executes a Windows LNK shortcut.
  • DDR: the LNK retrieves the next-stage command from an FTP banner at 157.254.194[.]31:21.
  • Second banner hop: the command fetches a second FTP banner from 167.148.41[.]164:21, which executes PowerShell to download, extract, and run a binary from a ZIP archive.
  • Payload: E4del, a Node.js-based RAT embedded in a digitally signed Electron application masquerading as Discord — signed-binary abuse plus a familiar consumer-app disguise.
  • Capabilities: defense evasion, persistence, system fingerprinting, encrypted C2; remote commands include interactive reverse shell, screenshot capture, live desktop streaming, file download, and additional payload delivery.
  • Dynamic beaconing: tiered jitter with three states based on time since last tasking — Active (first 20 s after a command: check-in every 200 ms–2 s), Semi-Active (no tasking for 20–40 s: 2–5 s intervals), Inactive (after 40 s: 5–9 s intervals).

PINHOLE chain (more advanced, high-reputation DDRs)

  • DDR: the FTP banner at 209.99.185[.]38:21 carries commands that use the MSXML2.XMLHTTP COM object inside PowerShell to retrieve a secondary command script from hxxps[://]cloudflare.milicare[.]in/app/c.
  • The script is saved as %TEMP%\u.cmd, executed, and deleted to minimize forensic footprint.
  • First stage: a wrapper claiming to be an update utility from a non-existent company, "Weston Computing Systems Ltd."; it employs the Halo's Gate technique to bypass security software.
  • High-reputation DDRs: PINHOLE uses Pinterest and SurveyMonkey as secondary dead drops to obtain C2 server details, and proxies C2 communication through Cloudflare Workers — a trust-layer stack (reputable consumer domains + Cloudflare) on top of the FTP-banner primitive.
  • Successful C2 resolution allows querying the domain for a next-stage payload.

Cross-campaign overlap

  • The WebDAV + LNK + rundll32.exe (conhost) delivery shape in the E4del chain matches the ClearFake / WordlistLoader → Amatera Stealer campaign documented by Gen Digital and Microsoft — the same threat cluster compromising legitimate websites and planting fake-CAPTCHA ClickFix lures. Track these as one tradecraft cluster, not separate campaigns.
  • Both RATs are new family labels; E4del's signed-Electron-Discord disguise and PINHOLE's Cloudflare-Workers-proxied C2 are distinct enough to warrant separate tracking even where infrastructure overlaps.

Indicators

  • 157.254.194[.]31:21 (E4del primary FTP banner DDR)
  • 167.148.41[.]164:21 (E4del secondary FTP banner DDR)
  • 209.99.185[.]38:21 (PINHOLE FTP banner DDR)
  • cloudflare.milicare[.]in/app/c (PINHOLE secondary command script)
  • %TEMP%\u.cmd (PINHOLE dropped command script)
  • "Weston Computing Systems Ltd." (PINHOLE fake-vendor wrapper)
  • Spanish-language voucher-claim lures driving LNK execution

Defender heuristics

  1. Flag FTP client/banner traffic from non-service processes (explorer, cmd, PowerShell, rundll32, LNK-launched binaries) — a malware stager opening an FTP session and parsing the banner is the DDR signature; plain web DDRs won't show this.
  2. Hunt MSXML2.XMLHTTP inside PowerShell — a classic living-off-the-land fetch primitive that bypasses many script-block policies.
  3. Track the WebDAV + LNK + rundll32 (conhost) shape as the shared ClearFake/ClickFix tradecraft cluster overlapping this campaign (see WordlistLoader / SynkLoader page).
  4. Treat signed Electron apps masquerading as Discord as hostile when they arrive via ZIP download from a script-execution chain — check Authenticode, parent process, and spawn tree rather than trusting the signature alone.
  5. Alert on Cloudflare Workers domains resolving after C2 discovery — PINHOLE proxies C2 through Workers, so the visible hostname is a relay, not the endpoint; resolve the actual destination and re-scope blocklists accordingly.
  6. Watch for tiered beacon jitter (200 ms→2 s → 2–5 s → 5–9 s) in E4del-style C2, which is tuned to look like normal client polling.

Sources