Dead Drop Resolver: FTP Banners Distribute New Remote Access Trojans
SOCRadar researchers have identified two previously unknown Remote Access Trojans (RATs) that use a novel attack vector: malicious commands hidden within the standard FTP server greeting banner.
The infection chain typically begins with a phishing email containing a manipulated Windows shortcut (.LNK file). When executed, this shortcut connects to an FTP server and automatically reads its welcome message. Instead of harmless metadata, these banners contain instructions sent directly to PowerShell, initiating a multi-stage payload download. This technique, dubbed the "Dead Drop Resolver," allows malware to fetch control server addresses from external sources like GitHub or social media rather than hardcoding them.
The first threat, named E4del, disguises itself by leveraging the legitimate Discord application. It downloads a modified version of the messenger that appears benign but executes hidden commands in a Windows console, captures screenshots, and uploads desktop images to attackers. The second variant, PINHOLE, employs a more complex obfuscation strategy. It temporarily stores malicious scripts as fake certificate files and deletes them after execution to minimize traces.
Both tools utilize popular platforms like Pinterest, SurveyMonkey, and Cloudflare Workers to hide their command-and-control infrastructure. While the FTP banner method is effective for initial access, SOCRadar notes that connections to unknown FTP servers are more easily flagged by network security systems compared to traffic on mainstream services like YouTube or GitHub.
Гика
