rintod / toolol

rintod (also circulating as toolol) is a 330-byte file uploader — the smallest tool in the entire corpus. Attributed to the Indonesian scene and hosted openly on a public GitHub repository (rintod/toolol), it contains a single form field for file selection and a single handler that writes the uploaded file to the current directory. No UI to speak of, no authentication, no file-type validation. At 17/62 on VirusTotal, it is well-known to the security industry — the opposite of the exclusive, undetected tools that dominate the rest of this collection.

Capabilities

A single form field for file selection and a single handler that writes the uploaded file to the current directory. No authentication, no file-type validation, no size limits. At 330 bytes, there is literally no room for a hidden function — the entire file is the upload form and the file-write handler. This gives the analyzed sample the lowest observed supply-chain risk in the corpus — no beacon, obfuscation, or hidden branch (which cannot, of course, vouch for forks or modified copies circulating elsewhere). An operator who deploys this sample gets exactly what they see: an uploader and nothing else.

That cleanliness is precisely why rintod matters in the broader ecosystem. It is used by the Flash-X toolkit as a stage-0 dropper: after achieving initial code execution on a target, the attacker plants rintod first (small enough to inject via a one-liner), then uses it to upload the real payload — a full-featured webshell, a config grabber, or a more capable tool. Rintod is the beachhead that enables everything that follows. Its simplicity is a feature: it is too small to trigger behavioral heuristics, too generic to signature reliably, and too clean to carry collateral risk.

Vulnerabilities

The contrast with Flash-X uploaders — which are only slightly larger at 1.7 KB but contain hidden mail() beacons, half-broken obfuscation, and dual-author identity leaks — illustrates the full spectrum of supply-chain trust in the T4 uploader tier. Rintod is honest. Flash-X backdoors the operator. The corpus shows that even at the simplest tier, the question of whether a tool does what it claims is never guaranteed.

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rule

rule tool_rintod_uploader {
    meta:
        description = "rintod/toolol minimal uploader (330 bytes)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/rintod/"

    strings:
        $upload    = "move_uploaded_file" ascii
        $tmp_name  = "$_FILES" ascii
        $form      = "multipart/form-data" ascii
        $input     = "<input" ascii nocase

    condition:
        filesize < 1KB
        and $upload
        and $tmp_name
        and ($form or $input)
}

Note: this rule is broad by design — the filesize < 1KB constraint is the primary FP reducer. Legitimate minimal upload forms may match; correlate with deployment context (e.g., file appearing in a webroot without version control history).

MITRE ATT&CK

OHIIHO Threat Research.