CyberGuard dictionary / Malware
Loader
A loader is code that prepares and starts another malicious component, often by unpacking, decrypting, downloading, or injecting it.
In simple terms
It is an early stage that gets the main payload running.
Technical explanation
A loader may resolve dependencies, evade inspection, or place code into another process before execution. The term describes a role in an attack chain; the same program can also behave as a dropper or backdoor.
Loaders prepare or launch later-stage malware and may fetch code from a remote source. Analysis distinguishes the initial loader from subsequent payloads and their capabilities.
Examples in practice
A small program decrypts a hidden payload in memory and starts it inside a legitimate process.
A document macro starts a small loader that downloads a remote-access program. The investigation tracks both stages so cleanup does not stop at the original document.
Why it matters
Finding a loader is a clue that additional malware and follow-on activity may be present.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.