{
  "family": "arload",
  "sample_count": 1,
  "category": "ransomware",
  "description": "TrojanDownloader:Win32/Arload is a specialized, highly compact trojan designed to breach endpoint defenses and securely deliver secondary payloads. True to its name, Arload acts purely as a 'stager' or loader. Its only objective is to silently connect to a Command-and-Control (C2) server and pull down the final, destructive payload (such as ransomware or a RAT) (`T1105`).<br><br><b>Understanding Arload (Lightweight Downloaders)</b><br>To an end-user, an Arload infection is entirely invisible. For an incident response team, the danger lies in what it brings with it. Because Arload contains very little code, it generates few static signatures, making it difficult for traditional AV to detect. It is often written in assembly or pure C to maintain its tiny footprint.<br><br><b>Execution and Evasion Strategies</b><br>Arload is commonly distributed via malspam campaigns or exploit kits. Upon execution, it does not establish persistence or inject into other processes (to avoid triggering behavioral heuristics). It simply utilizes basic Windows APIs (`URLDownloadToFile` or raw sockets) to make an HTTP/HTTPS GET request to a hardcoded domain to fetch the payload, executes the payload, and then often terminates itself.<br><br><b>Indicators of Compromise (IoCs)</b><br>Host-based IoCs are fleeting and difficult to spot without EDR. Look for the rapid execution of a very small (often under 20KB) executable from `%Temp%` or `%Downloads%`, immediately followed by the creation and execution of a larger secondary binary in the same directory. Network IoCs involve identifying the specific C2 domains or IP addresses the downloader contacted to fetch its payloads.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1566.001",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (The core function of fetching the secondary payload)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Primary distribution vector)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Relying on the user to execute the small stager)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; if Arload executed successfully, a much more dangerous secondary payload is already running.",
    "Analyze EDR and proxy logs to identify the C2 domains Arload contacted, and block those domains enterprise-wide.",
    "Determine the nature of the secondary payload (e.g., InfoStealer, Ransomware) and pivot the incident response strategy accordingly.",
    "Hunt for the specific spearphishing email that delivered the Arload stager and purge it from all user inboxes."
  ],
  "what_to_avoid": [
    "Do not close the incident simply because the AV quarantined the Arload executable; you must verify network logs to ensure the payload wasn't already downloaded.",
    "Avoid relying solely on file size filters in email gateways, as attackers frequently pad small downloaders with junk data to bypass them."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}