Malware Loader.

What is a malware loader?

A malware loader is a program that brings other malicious software onto a machine. It is also called a downloader. Its own job is usually small. It gets a foothold and then fetches the main payload, which is the part that does the real damage.

MITRE gives a well-known example. It describes Emotet as a modular malware variant that is primarily used as a downloader for other malware variants such as TrickBot and IcedID. MITRE adds that Emotet spreads through phishing emails with attachments or links, and that it uses obfuscated PowerShell and macro-based commands.

How does a loader work?

A loader usually works in steps. First it reaches a computer, for example through a phishing email. MITRE describes this for Emotet. Then it contacts a remote system and pulls down more software. MITRE names this idea Ingress Tool Transfer, which it describes as adversaries transferring tools or other files from an external system into a compromised environment. It is listed under the command and control tactic. MITRE also describes multi-stage downloaders, where a first-stage downloader contacts the command server to obtain the second-stage implant.

As a simple illustration, imagine a small program that does nothing visible except download a second program. The second program might be a remote access trojan or an information stealer. This example is generic and does not describe a specific case.

Why does it matter?

A loader makes the first compromise a stepping stone. Because MITRE describes Emotet as primarily a downloader for other malware, an infection that starts as a loader can later become something more serious. For defenders, this means that catching the early stage is valuable. Finding a loader can give a chance to act before the follow-on payload arrives.

How can you detect or reduce loaders?

The sources point to the delivery route and the download step. Since MITRE says Emotet spreads through phishing emails with attachments or links, email filtering and user care are relevant. Since the download step is a transfer of files from outside into the environment, network monitoring can help.

• Treat unexpected attachments and links with suspicion.
• Watch for systems that fetch files from unfamiliar external locations.
• Look closely at obfuscated PowerShell activity, which MITRE lists among Emotet’s methods.
• Remove the loader and also check for the follow-on payloads it may have brought.

Is a malware loader the same as a dropper?

The two words are close and are often used the same way. In general, a loader or downloader fetches code from elsewhere, while a dropper carries the code with it. Naming is not always consistent across reports, so check how each report uses the word.

Is a loader the same as a Trojan?

Not exactly. A Trojan is defined by pretending to be useful. A loader is defined by what it does, which is to deliver other malware. A single program can be both.

Related terms

See also trojan, command and control and malware as a service.

Related pages in the Knowledge Hub

• Emotet

Sources

• MITRE ATT&CK: MITRE describes Emotet as a modular malware variant primarily used as a downloader for other malware such as TrickBot and IcedID, spread by phishing and able to….
• MITRE ATT&CK: MITRE describes Ingress Tool Transfer as adversaries transferring tools or other files from an external system into a compromised environment, under Command and Control.