Hackers have learned to hide Trojan commands in FTP server banners

Hackers have discovered an unusual way to infect Windows by sending commands using an FTP server welcome banner. Experts have linked this new technology to the spread of two previously unknown remote access Trojans, E4del and PINHOLE.

Photo credit: Kandinsky

MalwareHunterTeam researchers discovered the scheme in July, and SOCRadar later confirmed that it is still in use. How resources are discovered Computer beepsthe attack starts with a ZIP file containing an LNK file, which is allegedly distributed via a phishing message and initiates further infection chains. As an intermediate source of commands, the attackers use FTP server banners, which are text messages that the server sends to connecting clients before authorizing them. The malicious downloader parses the FTP server’s response, extracts instructions to download a PowerShell script, and then executes it to continue infecting the system.

According to SOCRadar, the detected infrastructure uses two different infection vectors, with the E4del and PINHOLE Trojans being installed on computers. The first is a Node.js-based RAT packaged in a digitally signed Electron application disguised as Discord. E4del can execute commands via persistent or temporary shells, take screenshots, transfer desktop images via WebSocket, and download and run other components. The researchers also found mention of the crypto32.node module, which is designed to attempt to escalate privileges, but they were unable to obtain the module for analysis.

PINHOLE uses a different set of technologies. Its command and control server configuration was extracted from Pinterest posts and SurveyMonkey questions, allowing attackers to change the source of commands and make it difficult to shut down the malicious infrastructure. At the same time, the Trojan tries to leave minimal traces in the memory: only a portion of the payload, approximately 4KB in size, is stored in the memory due to the shellcode fluctuation technique, and then uses malicious code to inject the final assembly into the hung ApplicationFrameHost.exe process. PINHOLE supports a total of 14 commands, including searching for files, downloading and uploading files, executing commands, managing processes, taking screenshots, and installing modules for stealing credentials stored in the browser.

SOCRadar notes that using an FTP banner as the source of the command is an unusual alternative to the more common scheme of using legitimate web services such as X, GitHub or YouTube to achieve this purpose. However, this method cannot be considered completely invisible, as connections to unknown FTP servers are rare and therefore more likely to attract the attention of network monitoring tools.

Researchers say the technique is so versatile that it can even be applied to ClickFix attacks. At the time of analysis, the PINHOLE script recorded only 11 launches, indicating that the activity is still in its early stages. SORadar publishes indicators of compromise that can help investigators detect attack-related infrastructure and infected devices.