New E4del and PINHOLE RATs use FTP banners as dead drops for malware commands

Novel Malware Delivery Method

Cybersecurity researchers have identified a new campaign that leverages FTP banners as dead drop resolvers (DDRs) to distribute two new remote access trojans (RATs), named E4del and PINHOLE. This method involves using the welcome message an FTP server sends upon connection to deliver commands to malware stagers.

First Observed Use of FTP Banners for C2

While threat actors commonly abuse legitimate services for command-and-control (C2) infrastructure, this marks the first documented instance of FTP banners being used for this purpose in the wild. Although less stealthy than traditional web-based DDRs, this technique represents an unusual and notable development in malware delivery tactics.

Attack Chain Details

One attack chain observed involves Spanish-language lures, tricking users into executing a Windows Shortcut (LNK) file. This LNK then fetches the next-stage command from an FTP banner, which subsequently connects to a WebDAV server to download and execute a DLL export. This WebDAV approach has also been linked to ClearFake campaigns distributing other malware.

E4del RAT Capabilities

The E4del RAT, delivered via a multi-stage process involving multiple FTP banners, is Node.js-based and disguised as a digitally signed Electron application mimicking Discord. It possesses capabilities such as defense evasion, persistence, system fingerprinting, and encrypted C2 communication. E4del can facilitate an interactive reverse shell, screenshot capture, live desktop streaming, file downloads, and additional payload delivery.