Malware Loaders and Droppers Guide: First-Stage Malware and Detection

A malware loader is first-stage malware whose job is to get a foothold on a computer and then fetch and run other malware, and a dropper is first-stage malware that carries its payload inside itself and writes it to disk. In plain terms, they are the delivery van, not the cargo: the ransomware, remote access tool or infostealer arrives later, often sold to a different criminal group. That makes a "commodity" loader alert one of the most valuable early warnings a defender gets, because the time between a loader infection and hands-on-keyboard activity is the window in which an intrusion can still be stopped cheaply. This guide explains what loaders and droppers are, how they work at a defensive level, why they matter to the ransomware economy and law enforcement, and how to detect and respond to them with EDR, script control, attack surface reduction (ASR) rules and application control. It is written for SOC analysts, endpoint engineers and incident responders.

Key takeaways

• Loaders fetch, droppers carry. A loader (also called a downloader) retrieves its next stage from the network, while a dropper unpacks a payload it already contains; many modern families do both, so treat the labels as behaviours rather than strict categories.
• A loader alert is a ransomware precursor. CISA's #StopRansomware Guide names QakBot, Bumblebee and Emotet as common precursor malware and warns that a ransomware infection may indicate a previous, unresolved compromise.
• Loaders are a service industry. Operators rent access to infected machines or install other groups' payloads, which is why Europol's Operation Endgame (May 2024 onwards) targeted the "dropper ecosystem" and later its customers.
• Most loaders need a user and a script engine. Delivery usually relies on a user opening a file (MITRE ATT&CK T1204.002) and then on PowerShell, Windows Script Host or signed system binaries, so script control and ASR rules remove much of the attack surface.
• Response means finding the chain, not deleting a file. Before restoring or closing a ticket, identify what the loader downloaded, which credentials were exposed and whether access was handed on.

What it is

Both terms describe the first malicious code that runs on a victim device. Neither is usually the attacker's end goal. Their purpose is to establish execution, avoid detection long enough to deliver something else, and sometimes to report back what the device is worth.

MITRE ATT&CK reflects how blurred the categories are. It describes Emotet (S0367) as modular malware primarily used as a downloader for other families such as TrickBot and IcedID, Bumblebee (S1039) as a custom loader used by multiple actors, including possible initial access brokers, since at least March 2022, and Latrodectus (S1160) as a Windows downloader used since at least 2023 and most often distributed by email. QakBot (S0650) began as a banking trojan and evolved into a loader. For classifying malware more broadly by type, family and behaviour, see the Malware Guide.

How it works

The details vary by family, but each stage below is a point where a control can stop the chain or a log can record it.

1. Delivery: an email attachment or link (T1566.001), a malicious advert or poisoned search result, or a fake software update. Containers such as ZIP archives, ISO images and HTML pages that assemble a file in the browser are used to slip past gateway filters and Mark-of-the-Web checks. See the ISO and Container File Malware Delivery Guide, the HTML Smuggling Guide and the Malvertising and SEO Poisoning Guide.
2. User execution: the user opens a document, script, shortcut or installer (T1204.002). Office macros were the dominant trigger until Microsoft began blocking macros in internet files by default in 2022; delivery then shifted towards shortcut files, scripts and disk images. See the Macro Malware Guide and the Malicious LNK Files Guide.
3. Script or proxy execution: the first-stage file usually hands off to an interpreter such as PowerShell (T1059.001) or the Windows command shell (T1059.003), or to a signed Windows binary such as mshta (T1218.005), so that the visible process looks legitimate. See the Living off the Land Guide.
4. Unpack or download: a dropper decodes its embedded payload; a loader contacts its infrastructure and fetches the next stage. Obfuscation and packing (T1027) are the norm, and some loaders check the environment for sandboxes before continuing.
5. Execute and persist: the payload is run, often injected into another process or kept largely in memory (see the Fileless Malware Guide), and persistence is set through scheduled tasks, Run keys or startup shortcuts.
6. Triage and hand-off: the loader reports host details, and the operator decides what to install next: an infostealer, a remote access tool, a post-exploitation framework, or access sold to a ransomware affiliate.

Why it matters

The ransomware pipeline

Loaders sit at the start of most commodity ransomware intrusions. The US Department of Justice, announcing the QakBot takedown on 29 August 2023, said the FBI had identified more than 700,000 infected computers worldwide, that QakBot spread mainly through spam with malicious attachments or links, and that ransomware groups including Conti, ProLock, Egregor, REvil, MegaCortex and Black Basta used it as an entry point. CISA's #StopRansomware Guide says loader operators often sell network access and that responders should identify dropper malware such as Bumblebee, Dridex, Emotet, QakBot or Anchor before rebuilding from backups, to prevent continued compromise. See the Ransomware Prevention Guide and the Top 10 Ransomware Initial Access Vectors.

Loader-as-a-service

Loader operators rarely deploy ransomware themselves. They run distribution (spam campaigns, malvertising), maintain the botnet and sell either installs of a customer's payload or interactive access to selected victims. It also explains why loader families reappear under new names after disruption: the business model survives the takedown of one codebase.

Law enforcement disruption

For defenders the lesson is practical: disruptions reduce volume for a while, then successors appear. Detection should rest on behaviours that every loader needs, not on the names of this year's families.

Where identity fits

Loaders frequently install infostealers that harvest browser passwords, session cookies, API keys and cloud tokens from the infected device, and those secrets outlive the malware. Treat every confirmed loader infection as a credential exposure for the user and for any service account, developer token or SSH key present on the device. See the Infostealer Threat Guide.

Detection and controls

The following Microsoft Defender ASR rules (names as in Microsoft's ASR rules reference) target the stages above; equivalent controls exist in other EDR platforms.

Microsoft notes that the email and JavaScript/VBScript rules depend on cloud-delivered protection settings, and that rules can be set to off (0), block (1), audit (2) or warn (6). ASR events are written to the Microsoft-Windows-Windows Defender/Operational log: event 1121 when a rule blocks, 1122 when an audit-mode rule would have blocked, 1129 when a user overrides a warn-mode block, and 5007 when settings change. See the Application Allowlisting Guide and the PowerShell Security Guide.

Rolling out the controls:

1. Block the riskiest attachment types at the email gateway first, including inside archives where the gateway can inspect them; CISA advises reviewing attachment filter lists at least twice a year because password-protected archives can evade scanning.
2. Enable Microsoft's "standard protection" ASR rules in block mode, which Microsoft says can be done without extensive testing, and put the script and Office rules into audit mode on all devices.
3. Review 1122 events for two to four weeks, add narrow per-rule exclusions for genuine business processes, then move rules to block for a pilot ring before broad deployment. Roll back by returning a rule to audit (2) through the same management channel, never by adding broad path exclusions.
4. Restrict or disable Windows Script Host and the mshta handler where not needed, and enable PowerShell script block, module and transcription logging, retained for at least 180 days as CISA recommends.
5. Deploy application control in audit mode for user-writable locations (Downloads, AppData, Temp), then enforce.
6. Write detections for script engines and signed system binaries spawning network connections or child processes, and for new executables written to user-writable paths and run within minutes.

Metrics that show it is working:

• Percentage of Windows endpoints with the script and Office ASR rules in block mode (target above 95 percent).
• Number of ASR warn-mode overrides (event 1129) per month, trending down.
• Median time from first loader alert to device isolation.
• Percentage of loader incidents where credentials on the device were reset or revoked within 24 hours.
• Number of high-risk attachment types delivered to mailboxes (target zero).

Response to a loader infection

1. Isolate the device through EDR and preserve memory and the EDR timeline before reimaging.
2. Reconstruct the chain: delivery message or download, first execution, every downloaded stage and every outbound destination.
3. Hunt for the same indicators and behaviours across the estate, including other recipients of the same campaign. See the Threat Hunting Guide.
4. Reset the user's password, revoke sessions and tokens, and rotate any secrets stored on the device.
5. Check for signs of follow-on activity: new remote access tools, post-exploitation beacons, discovery commands or lateral movement. If present, escalate to a full incident. See the Incident Response Guide.

Common misconceptions

• "It was quarantined, so it is over." A loader that ran for even a few minutes may already have downloaded a payload or exfiltrated credentials. Quarantining the first file does not tell you what else executed.
• "Commodity malware is low priority." Commodity loaders are precisely how many ransomware intrusions begin, as the QakBot and Endgame cases show. Severity should follow what the loader can lead to, not how common it is.
• "Takedowns ended the problem." Europol's own later announcements describe successor groups and new variants re-emerging after the 2024 action.
• "Macros are blocked, so email attachments are safe." Attackers moved to shortcuts, scripts, disk images, HTML smuggling and malicious add-ins. See the Office Macro Blocking Guide.
• "Antivirus signatures are enough." Loaders are repacked constantly. Behavioural detection of script engines, system binaries and download-then-execute patterns is what survives family changes.

Related concepts

Framework mapping: NIST CSF 2.0 places these controls under PR.PS (platform security, including PR.PS-05, which covers preventing installation and execution of unauthorised software) and DE.CM (continuous monitoring). In NIST SP 800-53 Rev. 5 the relevant controls are SI-3 Malicious Code Protection, SI-4 System Monitoring, CM-7(5) authorised software allowlisting and SI-8 Spam Protection. CIS Controls v8.1 Control 2 (inventory and control of software assets, including 2.7 allowlist authorised scripts), Control 9 (email and web browser protections) and Control 10 (malware defences) apply, as does ISO/IEC 27001:2022 Annex A 8.7 Protection against malware.

Practitioner checklist

• Treat any loader or dropper detection as a potential ransomware precursor with incident-level triage.
• Block executable, script, shortcut and disk image attachments at the email gateway and review the list twice a year.
• Put the script, Office and prevalence ASR rules (or EDR equivalents) into audit, review 1122 events, then enforce.
• Disable Windows Script Host and unused script handlers; log PowerShell and retain logs for 180 days.
• Enforce application control on user-writable paths.
• Alert on script engines and system binaries making outbound connections or writing executables.
• Reset credentials, revoke sessions and rotate secrets on every confirmed loader infection.
• Hunt for follow-on tooling before closing the incident, and before restoring from backup after ransomware.

Standards and references

• CISA: #StopRansomware Guide
• Europol: Largest ever operation against botnets hits dropper malware ecosystem
• Europol: Operation Endgame strikes again, the ransomware kill chain broken at its source
• US Department of Justice: Qakbot malware disrupted in international cyber takedown
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Attack surface reduction events in Windows Event Viewer
• MITRE ATT&CK: Ingress Tool Transfer
• MITRE ATT&CK: User Execution: Malicious File

Related NHI Mgmt Group resources: Malware Guide · Macro Malware Guide · Ransomware Prevention Guide · EDR Guide · Infostealer Threat Guide