TinyMet — Malware Profile
TinyMet is a compact stager for Metasploit's Meterpreter, around 4 KB in size, written in C++ and published as source by Sherif Eldeeb on GitHub. It supports four Meterpreter transports — reverse_tcp, reverse_http, reverse_https and bind_tcp — and takes the transport, LHOST and LPORT at runtime either from command-line arguments or from underscore-separated fields in its own filename, so a copy renamed to "2_host.com_443.exe" runs with no arguments. Its role on a compromised host is to establish a communication channel between the attacker and the victim and to execute a file-less payload. TA505 has used TinyMet during the post-exploitation phase in order to deploy its Clop ransomware; Malpedia also associates the family with Anunak.