TinyLoader Uses USB and Network Shares to Spread Malware and Hijack Crypto Transactions
Summary
An investigation maps TinyLoader infrastructure and details how the loader delivers Redline Stealer and DCRat, persists and spreads through USB drives and network shares, and replaces copied cryptocurrency addresses.
Key points
- TinyLoader downloads additional payloads, including Redline Stealer and DCRat, from attacker-controlled infrastructure.
- The investigation identified command-and-control infrastructure in Latvia, the UK, and the Netherlands, including TinyLoader login panels and DCRat samples.
- The malware spreads through USB drives and accessible network shares, using deceptive filenames and shortcuts.
- It maintains persistence with hidden copies and Windows registry changes, including hijacking text-file associations when it has administrator rights.
- A background process monitors the clipboard and replaces recognized Bitcoin, Ethereum, Litecoin, and TRON addresses with attacker-controlled addresses.
- The report recommends hunting for the panel signature “Login - TinyLoader,” blocking identified infrastructure, and monitoring USB propagation, suspicious file creation, registry changes, and clipboard activity.
Article Details
- Attack Vectors
- TinyLoader downloads and executes secondary payloads from attacker-controlled URLs.
- The malware spreads through USB drives and accessible network shares, including by creating an autorun file on removable media.
- A deceptive desktop shortcut named "Documents Backup.lnk" is used to trick users into executing the malware.
- TinyLoader persists by creating hidden copies and modifying Windows text-file associations in the registry.
- The malware monitors the clipboard and replaces copied cryptocurrency addresses with the attacker's addresses.
- Defensive Notes
- Monitor network traffic and web crawler data for the HTML signature "Login - TinyLoader"; block the identified malicious IP addresses.
- Restrict and scan USB devices, and monitor network shares for suspicious executables such as "Update.exe".
- Alert on registry changes affecting file associations and on multiple executables being created in user directories.
- Verify cryptocurrency wallet addresses before sending transactions; monitor for high-frequency clipboard activity.
- Scan USB drives before opening files, especially executables disguised with document-style double extensions.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 107[.]150[.]0[.]155 | Host from which active DCRat malware samples were captured; identified as malware-distribution infrastructure. |
| IPV4 | 176[.]46[.]152[.]46 | Identified as an additional TinyLoader panel host. |
| IPV4 | 176[.]46[.]152[.]47 | Identified as a TinyLoader command-and-control panel host and malicious infrastructure. |
| IPV4 | 77[.]90[.]153[.]62 | Listed as one of the IP addresses in the TinyLoader infrastructure IOC table. |
MITRE ATT&CK
T1091 · Replication Through Removable MediaTinyLoader copies itself to USB drives and creates an autorun file to infect other systems.T1105 · Ingress Tool TransferTinyLoader downloads secondary payloads, including files named bot.exe and zx.exe, from attacker-controlled URLs.T1115 · Clipboard DataA background process monitors clipboard contents for cryptocurrency addresses.T1204.002 · Malicious FileThe malware uses a deceptive Documents Backup.lnk shortcut to induce users to execute it.T1546.001 · Change Default File AssociationWith administrator rights, the malware modifies the registry to run when text files are opened.T1564.001 · Hidden Files and DirectoriesThe malware marks copies of itself as hidden in user directories and other accessible locations.T1570 · Lateral Tool TransferThe malware copies itself to accessible network shares as Update.exe.
Malware
DCRatIt has been linked to stealing cryptocurrency and delivering other malware like Redline Stealer and DCRat.RedLine Stealerof these loaders. It has been linked to stealing cryptocurrency and delivering other malware like Redline Stealer and DCRat.TinyLoaderthey give attackers a reliable way to get into systems and then bring in whatever tools they need. TinyLoader is one of these loaders. It has been linked to stealing cryptocurrency and delivering other malware
Vendors
Railnet LLCtool captured active malware samples from one of the identified IPs (107.150.0.155) hosted by Railnet LLC in Great Britain. The capture occurred on August 8th, 2025, revealing four malicious files totaling 211Virtualine TechnologiesNetherlands. What's interesting is that all four addresses are hosted by the same provider: Virtualine Technologies. This suggests the attackers are keeping things simple by using one hosting company, though it