Security Operations · Advanced

Loader

First-stage malware that downloads or decrypts and executes additional payloads on a compromised system.

Definition

Loaders such as Bumblebee, IcedID and SmokeLoader establish a foothold, perform reconnaissance and then retrieve follow-on malware such as Cobalt Strike or ransomware, often for paying customers. They commonly use process injection and sandbox evasion. Detecting the loader stage can prevent the more damaging later stages.

Related terms