Loader / Dropper

Description

They arrive by the usual routes — a Trojan, an attachment, a macro, an exploited vulnerability. Because they are small and do nothing suspicious at first, they slip past protection more easily. Once settled they fetch what they were sent for: ransomware, infostealers, remote access tools, other malware. Loaders are now rented out as a service — attackers pay to have their cargo smuggled in.

The split of roles is planned in advance: the courier is light and disposable, and the real cargo arrives only once the ground has been checked and the target confirmed. For the defender this means a small alert cleared in a hurry can be the announcement of something larger. If the loader managed to call home, the infection may already have been delivered.

Examples

• A macro in a suspicious invoice does not install ransomware straight away; it starts a small loader that pulls down the tools needed for the next stages of the attack.
• A dropper usually comes with fake installers of well-known software packages. Once active it releases the main payload and removes itself from the machine to hide the trace.
• The antivirus reports a threat and removes it, and the threat keeps coming back. The cause is usually a dropper or a loader hidden in some script in the browser cache, which the antivirus does not read as a threat because it carries none of the marks of malicious software.

Notes

• The courier is simple and disposable; the real payload is still on its way. That is why small, harmless-looking alerts can be the announcement of a larger infection.
• When the antivirus reports a dropper or a loader, the real question is what that program managed to fetch before it was caught.