CyberGuard dictionary / Malware
Dropper
A dropper is a program whose main role is to deliver or install another malicious component onto a system.
In simple terms
The first file a user opens may be only the installer for the actual payload.
Technical explanation
Droppers can unpack embedded files, write payloads to disk, change configuration, and then execute the next stage. Some overlap with downloaders or loaders, but the core idea is staging another component.
A dropper's immediate purpose is to install another payload; the final behavior depends on what it delivers. Blocking the first file does not prove the second stage never ran.
Examples in practice
A fake invoice attachment runs a small dropper that installs a credential-stealing program and then exits.
A fake update utility writes a separate executable into a temporary directory and starts it. The team checks process and file history to determine whether that payload executed.
Why it matters
Investigators should look for the installed payload and its actions, not stop at the initial file.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.