{
  "family": "tinyloader",
  "sample_count": 203,
  "category": "downloader",
  "description": "TrojanDownloader:Win32/Tinyloader is a minimalist, highly evasive payload dropper engineered specifically for advanced, multi-stage attacks to quietly bypass endpoint defenses and download severe secondary payloads.<br><br><b>What is Tinyloader?</b><br>For the end-user, Tinyloader operates silently in the background, entirely invisible. For threat intelligence analysts, Tinyloader represents a sophisticated staging mechanism. As the name implies, its compiled footprint is extremely small (often just a few kilobytes). It utilizes dynamic API resolution and heavy obfuscation to hide its true intentions from static scanners. Its sole purpose is to establish a foothold, decrypt a C2 address, and execute a secondary payload directly in memory.<br><br><b>Infection Vectors & Threat Hunting</b><br>Tinyloader is frequently utilized in highly targeted spearphishing campaigns, dropped by weaponized Office documents containing malicious macros. Upon execution, Tinyloader performs extensive environment checks to ensure it is not running in a sandbox. Once validated, it reaches out via HTTP GET requests to download the final payload (often a RAT, banking trojan, or Cobalt Strike beacon). It frequently uses techniques like Process Hollowing to inject and execute the final payload without ever writing it to disk.<br><br><b>Forensic Analysis & Impact</b><br>The impact of Tinyloader is entirely dependent on the secondary payload it delivers. Incident responders should hunt for EDR alerts related to 'Process Hollowing' or 'Suspicious Memory Allocation'. Memory forensics is absolutely critical; analysts must dump the memory of the hollowed process (like <code>explorer.exe</code>) to extract the unencrypted secondary payload, as it never touches the disk. Tiny network beacons reaching out to newly registered domains are strong IoCs.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1027",
    "T1055.012",
    "T1497.001",
    "T1129"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055.012",
      "name": "Process Injection: Process Hollowing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1129",
      "name": "Shared Modules",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately to prevent the secondary, memory-resident payload from establishing C2 communications or moving laterally.",
    "Perform a live memory capture (e.g., using WinPmem) before powering down the machine to ensure the hollowed process payload can be extracted.",
    "Analyze the initial infection vector (e.g., the spearphishing email) to determine the scope of the targeted attack.",
    "Force a password reset for the compromised user and rebuild the OS from a known-good image."
  ],
  "what_to_avoid": [
    "Do not reboot the machine before capturing memory; the secondary payload exists solely in RAM and will be lost, hindering the investigation.",
    "Avoid relying on static file analysis of the Tinyloader dropper, as the heavy obfuscation and minimal code will yield minimal intelligence."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}