CyberGlossary

Malware

Dropper

Also known as: Malware dropper, Installer dropper

Definition

Malware whose role is to install ("drop") another malicious payload onto a target system, often after evading initial detection.

A dropper is a delivery component that carries one or more embedded payloads inside its own body and writes them to disk or memory once executed. Unlike a downloader, it does not need to contact the internet for the next stage. Droppers often arrive as macro documents, ISO/IMG containers, signed installers, or trojanized utilities. They commonly include anti-analysis checks, decoy content, persistence setup and process-injection routines before launching the final malware (info-stealer, ransomware, RAT). Defences include email and web filtering, attachment sandboxing, application allow-listing, EDR with behaviour-based detection, and disabling auto-execution of macros and ISO mounting.

Examples

  • Emotet maldocs dropping Trickbot or Cobalt Strike on infected hosts.
  • ISO/LNK droppers used by Qakbot to bypass Mark-of-the-Web.

Related terms