Loading malware…
PINHOLE is a 64-bit Windows remote access trojan compiled with MinGW-w64 and identified in activity observed from July 2026. Its multi-stage delivery chain abuses FTP server welcome banners as dead-drop resolvers, retrieving embedded commands before authentication to initiate PowerShell-based payload retrieval and execution. The first-stage binary masquerades as an update utility from the fictitious Weston Computing Systems Ltd. PINHOLE and E4del represent distinct malware clusters sharing the FTP-banner delivery technique; no known threat actor has been reliably attributed to PINHOLE.
PINHOLE obtains command-and-control configuration from Pinterest pins and SurveyMonkey survey questions and proxies communications through Cloudflare Workers. It stores configuration in NTFS alternate data streams and establishes persistence through a per-user Windows startup registry setting. Its evasion mechanisms include anti-analysis checks, dynamic API resolution, Halo’s Gate direct system calls, six decryption or unpacking layers, and shellcode fluctuation that keeps only one 4 KB payload segment decrypted and executable at a time. The final RAT payload executes inside a legitimate suspended Windows process through Early Bird APC Injection.
The RAT communicates using HTTP GET and POST requests for task polling, result exfiltration, and file transfer. Its 14 supported commands provide directory enumeration, recursive file search, file upload and download, deletion, process listing and termination, screenshot capture, additional payload execution, and interactive PowerShell sessions. It can also deploy a browser credential-stealing module. These functions enable remote system control, reconnaissance, credential theft, and data exfiltration.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
T1047 — Windows Management Instrumentation (Execution)
E4del способен выполнять шелл-команды; PINHOLE умеет выполнять команды PowerShell и открывать PowerShell-сессии.
PINHOLE поддерживает выполнение команд PowerShell и открытие PowerShell-сессий.
6 couches de déchiffrement : faux JPEG ... XOR ... Donut ... aPLib
The end goal of the attack is to deliver E4del, a Node.js-based RAT that's embedded within a digitally signed Electron application masquerading as Discord.
E4del ... se faisant passer pour Discord ... PINHOLE ... se faisant passer pour un utilitaire de mise à jour de « Weston Computing Systems Ltd »
The payload is subsequently handed off to an Early Bird APC Injection routine to run it inside a legitimate, suspended process
Пейлоад внедряется в приостановленный процесс ApplicationFrameHost.exe с помощью метода Early Bird APC Injection.
This script is saved as %TEMP%u.cmd, executed, and subsequently deleted to minimize the forensic footprint.
Décodage via certutil -decode → archive Cabinet → calc.exe
The final injected executable contains the RAT functionality of PINHOLE, which entails communicating with the C2 server over HTTP GET and POST requests to poll for commands and send the results back
C2 chiffré AES-256-CBC ... via HTTP POST ... Le trafic est proxifié via Cloudflare Workers
Злоумышленники используют FTP-баннеры в качестве dead drop resolver (DDR) для передачи команд; команды встраиваются в приветственные сообщения FTP-серверов до аутентификации.
Конфигурацию C2 PINHOLE получает через Pinterest и SurveyMonkey, при этом соединения проксируются через Cloudflare Workers.
uses high-reputation platforms like Pinterest and SurveyMonkey as DDRs to obtain the C2 server details and proxy the communication through Cloudflare Workers.
FTP-баннеры используются в качестве dead drop resolver (DDR) для передачи команд. PINHOLE может получать конфигурацию управляющих серверов через пины на Pinterest и вопросы в SurveyMonkey.
Les acteurs malveillants intègrent des commandes malveillantes directement dans les bannières de réponse initiale du protocole FTP (port 21).
33 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as background research concerning command-delivery patterns associated with FTP banners. No additional capabilities or attribution are provided.
A multi-stage remote-access trojan with six unpacking layers designed to minimize in-memory artifacts. It supports 14 commands for file and process operations, screenshots, PowerShell command and session execution, and launching additional payloads or binaries. Its operators use an FTP Stats Panel to track connections, unique IPs, and script executions.
A more advanced remote access trojan that uses FTP banners plus high-reputation platforms such as Pinterest and SurveyMonkey as dead drop resolvers, proxies communications through Cloudflare Workers, employs Halo's Gate and Early Bird APC Injection for evasion, and supports command polling, file upload/download, screenshot capture, process management, PowerShell execution, and retrieval of a browser stealer module.
Sophisticated 64-bit multi-stage remote access trojan delivered via FTP-banner DDR and PowerShell, masquerading as an updater. It uses layered decoding/decryption, Halo’s Gate direct syscalls, Early Bird APC injection, ADS-based configuration storage, and dead-drop C2 retrieval from Pinterest and SurveyMonkey proxied through Cloudflare Workers. It supports file operations, process control, screenshot capture, browser credential theft, and PowerShell execution.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.