Downloader, or dropper malware is a malware type that is used in a wide range of attacks. The main purpose of this virus type is to deliver the malicious payload to the victim’s PC, additionally defusing the protection mechanisms.
Downloader malware threat summary
Downloader virus is a malicious script, or a piece of code embedded into the application. Those apps are oftentimes dubious tools of some sort – keygens, cheat engines or activation tools. To use them, you must disable anti-malware programs, so they can easily act in your system without the risk of detection. Nonetheless, some of the downloaders are well-made and can act even as separate apps.
Downloader malware examples:
The most common form of downloader malware is trojan. The “naked” downloaders are also present, but they never spread without the “carrier”. You can see the combination of an application and a “patch” which in fact is a downloader malware. The installation guide in these cases definitely says that you must not even try to launch the program without starting the patch first. Then, you will see a strange process running in the background – and likely ignore it. Downloaders, just like coin miners, often take the names of legitimate programs or system elements.
How do downloaders act?
Downloader viruses are pretty simple undercover, especially in contrast to other “primary” malware – exploits. All they have to do is make your system weaker and open the gates for further viruses. Downloaders may easily be detected by anti-malware engines by the attempts to delete or suspend the antivirus programs. After this first action, downloader malware establishes the connection to the command server, where it asks for malware payload.
There is no typical target for downloader malware. They can be used in attacks on both individuals and corporations. The main profit of using the downloader malware is preliminary testing the target. If it is possible to perform the attack – the downloader will do all the dirty job before the main payload injection. What actual viruses will be injected – no one knows. It may be the pack of different adware or hijackers, as well as ransomware and spyware.
Such an easy mechanism may be realized through scripts, as well as with “regular” programming languages. Scripts are very simple to make, but much harder to execute when the target system has at least one anti-malware program running. More complex things are harder to hide, that’s why cybercriminals try to find a shell or satellite for them. In rare cases downloaders act in conjunction with exploits – the latter ones exploit the vulnerabilities, then incite the downloader to do its dirty job.
How to protect yourself from that malware type?
Downloaders are hard to stop when they have already launched. They are too fast for you to react, and the only thing you can do is to shut it down in the Task Manager. If you have instantly managed to understand that something is wrong, of course. So the best way to stop it is to prevent it. Using the most modern anti-malware programs will definitely make your life easier.
Also, don’t forget about the basic principles of computer hygiene. When you don’t provoke the malware appearance – it will not appear, right? Use Internet resources safely – it is the biggest source of malware these days. There is no way to get infected from just opening the website, as in the ‘00s, but you still can get something unpleasant through exploited pages. Also, stop using untrustworthy sources of programs. You never know the intentions of a person who published “the extremely useful tool” on the forum for free. It is better to avoid such places unless you are sure that this user will not deceive you. Still, it is not the case for “software sites”.