Loading malware…
E4del is a Windows remote access trojan built with Node.js and Electron that masquerades as Discord. It replaces the application's packaged JavaScript logic while retaining the legitimate, digitally signed Discord executable. It was identified in malware delivery activity observed since July 2026 that uses FTP server welcome banners as dead-drop resolvers, embedding instructions in responses received before authentication. Observed delivery chains use Spanish-language voucher lures and Windows shortcut files, followed by staged retrieval and execution through WebDAV and PowerShell. E4del and PINHOLE are distinct malware clusters sharing this delivery technique; no known threat actor attribution has been established.
E4del supports shell command execution, interactive reverse-shell access, screenshot capture, live desktop streaming over WebSocket, file deployment, and downloading and executing additional payloads. It establishes persistence through Electron's login-item functionality, generates a hardware identifier from network adapter addresses and CPU information, and enumerates installed security products. Launch-argument and username checks provide anti-analysis controls, while Chromium runtime options allow it to operate invisibly in the background.
Command-and-control communications use AES-256-CBC-encrypted HTTP POST requests. A three-state jittered beaconing scheme varies polling frequency according to recent task activity, using rapid check-ins after commands and progressively longer intervals during inactivity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
T1047 — Windows Management Instrumentation (Execution)
E4del способен выполнять шелл-команды; PINHOLE умеет выполнять команды PowerShell и открывать PowerShell-сессии.
the FTP banner at "157.254.194[.]31:21" utilizes a multi-stage delivery chain that fetches a second FTP banner from "167.148.41[.]164:21," which executes PowerShell to download, extract, and run a binary from a ZIP archive.
startcmd initializes a persistent, hidden cmd.exe child process
Les acteurs malveillants intègrent des commandes malveillantes directement dans les bannières de réponse initiale du protocole FTP
it establishes persistence by utilizing Electron’s native login item settings ( setLoginItemSettings ), configuring the host executable ( Discord.exe ) to launch automatically upon user login
E4del представляет собой Node.js RAT, упакованный в подписанное Electron-приложение, которое маскируется под мессенджер Discord.
E4del ... se faisant passer pour Discord ... PINHOLE ... se faisant passer pour un utilitaire de mise à jour de « Weston Computing Systems Ltd »
Les acteurs malveillants intègrent des commandes malveillantes directement dans les bannières de réponse initiale du protocole FTP
The command connects to a WebDAV server to download and execute a DLL export via "rundll32.exe" using conhost.
E4del ... remplace le fichier app.asar de Discord tout en conservant le binaire Discord.exe signé numériquement.
Anti-sandbox : vérification ... du nom d’utilisateur Windows
The RAT supports various capabilities, such as defense evasion, persistence, system fingerprinting, and encrypted C2 communication
C2 chiffré AES-256-CBC ... via HTTP POST ... Le trafic est proxifié via Cloudflare Workers
Злоумышленники используют FTP-баннеры в качестве dead drop resolver (DDR) для передачи команд; команды встраиваются в приветственные сообщения FTP-серверов до аутентификации.
FTP-баннеры используются в качестве dead drop resolver (DDR) для передачи команд. PINHOLE может получать конфигурацию управляющих серверов через пины на Pinterest и вопросы в SurveyMonkey.
Les acteurs malveillants intègrent des commandes malveillantes directement dans les bannières de réponse initiale du protocole FTP (port 21).
E4del может скачивать файлы и запускать дополнительные пейлоады; PINHOLE может запускать дополнительные пейлоады и бинарники.
Les acteurs malveillants intègrent des commandes malveillantes directement dans les bannières de réponse initiale du protocole FTP
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as background research concerning command-delivery patterns associated with FTP banners. No additional capabilities or attribution are provided.
A Node.js remote-access trojan that executes shell commands, captures screenshots, streams the victim desktop over WebSocket, downloads files, and launches additional payloads. It varies C2 polling intervals based on activity to make network traffic appear less suspicious.
A Node.js-based remote access trojan embedded in a digitally signed Electron app posing as Discord. It supports defense evasion, persistence, system fingerprinting, encrypted C2 communications, interactive reverse shell access, screenshot capture, live desktop streaming, file download, and delivery of additional payloads.
Remote access trojan based on Node.js/Electron that masquerades as Discord by replacing app.asar while retaining the signed Discord.exe binary. It performs anti-sandbox checks, establishes persistence via Electron setLoginItemSettings, fingerprints hosts, detects security products, uses AES-256-CBC encrypted HTTP POST C2, and supports commands including reverse shell, screenshot capture, live desktop streaming, payload dropping, file deployment, privilege escalation, and shell execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.