| name | analyzing-loaders-and-droppers |
| description | Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or map multi-stage delivery behavior. |
| domain | cybersecurity |
| subdomain | malware-analysis |
| tags | ["malware-analysis","loader","dropper","multi-stage","delivery"] |
| version | 1.0.0 |
| author | analyst-ai-pack |
| license | Apache-2.0 |
| mitre_attack | ["T1105","T1140","T1574"] |
| d3fend | ["D3-DA","D3-FCR"] |
| references | ["MITRE ATT&CK T1105 Ingress Tool Transfer — https://attack.mitre.org/techniques/T1105/","MITRE ATT&CK T1140 Deobfuscate/Decode Files or Information — https://attack.mitre.org/techniques/T1140/"] |
Analyzing Loaders and Droppers
When to Use
- You have a first-stage loader/dropper and need to find the next stage: an embedded resource, an
appended overlay, or a download URL.
- You need to identify the decode/decrypt routine and the execution mechanism (process creation,
injection, scheduled task, DLL side-loading).
Do not use this to run the loader and fetch live stages — characterize staging statically and
retrieve next stages only in an isolated sandbox.
Prerequisites
- The loader/dropper sample (read inertly).
Safety & Handling
- Read bytes statically; defang download URLs; never execute to pull live payloads.
Workflow
Step 1: Locate staged payloads
python scripts/analyst.py stage sample.bin
Detects embedded PE/archive signatures, an appended overlay beyond the PE's mapped size, large
high-entropy blobs, and download URLs.
Step 2: Identify decode/execution mechanism
Scan imports/strings for decode APIs (CryptDecrypt, base64), download APIs (URLDownloadToFile,
WinHttp, InternetReadFile), and execution (CreateProcess, ShellExecute, WinExec,
side-loading hints).
Step 3: Map the delivery chain
Document stage-1 → decode → stage-2 → execution and map each step to ATT&CK.
Step 4: Defang and report
Defang URLs and produce IOCs for the staging infrastructure.
Validation
- Embedded/overlay stages are confirmed by signature or entropy, with offsets recorded.
- Download URLs and execution mechanism are identified from imports/strings.
- The multi-stage chain maps cleanly to ATT&CK techniques.
Pitfalls
- Treating a benign overlay (installer data, signature) as a payload without corroboration.
- Missing stages fetched at runtime when no URL is in plaintext (obfuscated/encoded).
- Confusing the decode routine for the payload itself.
References
