Dropper.

A dropper is a delivery component that carries one or more embedded payloads inside its own body and writes them to disk or memory once executed. Unlike a downloader, it does not need to contact the internet for the next stage — the malicious code travels with it. Droppers commonly bundle anti-analysis checks, decoy content, persistence setup, and process-injection routines before launching the final malware (info-stealer, ransomware, RAT).

Delivery formats track defender controls. When Microsoft disabled Office macros by default for internet-sourced files in 2022, Proofpoint measured VBA/XL4 macro use fall roughly 66%, and crews such as Qakbot, IcedID, and Bumblebee pivoted to ISO/IMG containers and LNK shortcuts. The trick is a Mark-of-the-Web (MOTW) bypass: the downloaded archive carries the MOTW tag, but files extracted from an ISO or IMG do not inherit it, so Windows treats the inner document or LNK as locally trusted. LNK-based campaigns rose over 1,600% after the change. Signed installers and trojanized utilities are also popular dropper vehicles.

flowchart LR
  MAIL[Phishing email] --> CONT[ISO / IMG / signed installer]
  CONT -->|MOTW bypass<br/>inner file untagged| DROP[Dropper executes]
  DROP --> AA[Anti-analysis + decoy]
  DROP --> EMB[Embedded payload<br/>written to disk/memory]
  EMB --> INJ[Process injection]
  INJ --> FINAL[Stealer / Ransomware / RAT]
  DEF[Defence] -. sandbox, allow-listing, block ISO mount, EDR .-> DROP

Defences include email and web filtering, attachment sandboxing, application allow-listing, EDR with behaviour-based detection, blocking automatic ISO/IMG mounting, and disabling macro auto-execution.