A dropper is a type of malware whose only job is to install another malicious program – the payload it carries inside itself – on the victim’s device while avoiding detection.
How a dropper works
A dropper usually arrives disguised as something harmless: an email attachment, a cracked game, a fake invoice or a utility app. When it runs, it unpacks or decrypts the embedded payload, writes it to disk or injects it into memory, and starts it. Many droppers then delete themselves to hide the trail. Droppers rely heavily on packers, encryption and anti-analysis checks: they may refuse to unpack inside a virtual machine or sandbox, or wait hours before acting.
The difference from a malware loader is subtle and the terms are often mixed up: a dropper carries the payload with it, while a loader or downloader fetches it from a remote server.
Why droppers matter
- Mobile banking malware – researchers have repeatedly found dropper apps on Google Play posing as PDF readers, QR scanners or file managers. They passed store review because they looked clean, then installed banking trojans such as Anatsa (TeaBot) after a fake “update”.
- Multi-stage attacks – droppers make the first stage small and clean, so security tools see little to flag, while the real payload – a trojan, infostealer or ransomware – only appears later.
- Flexibility – criminals can swap the payload without changing the delivery chain.
How to protect against droppers
- Install apps only from official stores and check permissions, especially requests to install other apps.
- Do not run attachments or cracked software from unknown sources.
- Use endpoint protection with behavioural detection, which spots a process writing and launching executables.
- Block execution from temporary and download folders with application control.
