E4del and PINHOLE Abuse FTP Banner Dead Drops for C2

Summary

Threat actors are abusing FTP server greeting banners as dead-drop resolvers to deliver E4del and PINHOLE malware. By leveraging the FTP protocol’s pre-authentication phase, attackers can pass commands directly into a victim-side interpreter without transferring traditional files. This technique enables stealthy living-off-the-land infection chains that can evade many file-based security controls.

Investigation

The investigation examined three delivery variants: piping FTP output into command interpreters, using WebDAV over HTTP for second-stage execution, and relying on BITS-based downloads. Researchers identified a cluster of FTP hosts acting as redirectors and payload-delivery nodes. Analysis of E4del and PINHOLE also revealed techniques such as Electron-based impersonation, shellcode fluctuation, and direct system calls designed to bypass API hooking.

Mitigation

Defenders should emphasize behavioral detection instead of relying on file hashes, particularly by monitoring outbound TCP/21 connections followed by immediate command interpreter execution. Strict controls over conhost.exe, bitsadmin.exe, and WebDAV-based UNC paths can reduce exposure. Security teams should also monitor suspicious child processes spawned by ApplicationFrameHost.exe.

Response

If this activity is detected, affected endpoints should be isolated immediately to prevent additional command execution or data exfiltration. Responders should perform memory forensics to identify injected code, especially within legitimate processes such as ApplicationFrameHost.exe. PowerShell Script Block logs should also be reviewed to reconstruct commands received through the FTP dead drop and determine the scope of compromise.

Simulation Execution

• Attack Narrative & Commands: The adversary aims to retrieve a command via an FTP “dead drop.” Instead of downloading a file, the adversary initiates a connection to a controlled FTP server. When the interpreter (PowerShell) connects, it reads the server’s banner, which contains the encoded next-stage command. This avoids the “file download” signature and relies on the protocol handshake itself to deliver the trigger. We will use PowerShell to attempt a connection to a listener on port 21.

• Regression Test Script:

  # Simulation: PowerShell attempting to connect to an FTP service on Port 21
  # This mimics the 'dead drop' behavior of E4del/PINHOLE
  
  $TargetIP = "127.0.0.1" # In a real test, point to a controlled listener
  $TargetPort = 21
  
  Write-Host "[+] Starting Simulation: Connecting to FTP Banner Dead Drop..." -ForegroundColor Cyan
  
  try {
      # Using System.Net.Sockets to trigger a Network Connection event via PowerShell
      $client = New-Object System.Net.Sockets.TcpClient
      $client.Connect($TargetIP, $TargetPort)
      Write-Host "[!] Success: Connection established. Telemetry should be generated." -ForegroundColor Green
      $client.Close()
  }
  catch {
      Write-Host "[-] Connection failed (expected if no listener is active), but telemetry should still exist." -ForegroundColor Yellow
  }

• Cleanup Commands:

  # Cleanup: Ensure no residual connections or processes remain
  Stop-Process -Name "powershell" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup Complete." -ForegroundColor Green