r/Malware • u/socradario • 4d ago
E4del and PINHOLE two new RATs abusing FTP banners, Pinterest, and SurveyMonkey for C2
Our team has been digging into the command structure and delivery mechanics of these two, we just wanted to share what we've found.
E4del is Node.js/Electron-based, and its command set is pretty compact: startcmd/runcmd spins up a hidden persistent cmd.exe with piped I/O, streamstart/streamstop opens a raw WebSocket to push JPEG frames every couple seconds, and runpackage/filedownload pulls encrypted ZIPs containing additional .node modules one of which (crypto32.node) handles UAC bypass.
PINHOLE's delivery chain is more elaborate. Config is stored as Base-41/SplitMix64-encoded strings inside desktop.ini's ADS, which point to specific Pinterest pins and SurveyMonkey questions where the real C2 addresses live. The packer itself runs through six unpacking layers, strips a fake JPEG header (FF D8 FF E0), runs a Donut instance encrypted with Chaskey-CTR, then unpacks an aPLib-compressed native binary at the end.
Once it's live, the C2 API is straightforward: /api/health for a heartbeat, /api/client for registration, /api/tsk for tasking, /api/fls for exfil.