{
  "family": "loader",
  "sample_count": 9,
  "category": "ransomware",
  "description": "Trojan:Win32/Loader (or generic **Loader / Downloader** heuristics) represents the foundational building block of the modern cybercrime ecosystem. A Loader is a specialized, lightweight piece of malware whose sole purpose is to securely bypass perimeter defenses, establish a foothold, and download the 'heavy' secondary payloads (like ransomware, infostealers, or botnet modules) from a remote Command and Control (C2) server.<br><br><b>Understanding Loaders</b><br>To a victim, the execution of a Loader is completely invisible. For a security analyst, a Loader detection indicates a critical breach of the perimeter. Cybercriminal syndicates often specialize; 'Initial Access Brokers' develop and distribute Loaders, and then sell the access (the ability to trigger the download) to ransomware affiliates. Famous examples of advanced Loaders include Emotet, Qakbot, and IcedID.<br><br><b>Execution and Evasion Strategies</b><br>Loaders are the primary payload of phishing campaigns (`T1566.001`), often embedded in weaponized Office documents (macros) or smuggled inside ISO/IMG files to bypass Mark-of-the-Web (MotW) protections. Upon execution (`T1204.002`), the Loader performs environment checks (`T1497.001`) to ensure it isn't in a malware sandbox. If the environment is 'clean', it establishes basic persistence (e.g., a simple Scheduled Task) (`T1053.005`). It then decrypts a hardcoded list of C2 URLs and initiates an encrypted HTTPS connection (`T1071.001`). It profiles the infected machine (OS version, domain joined status) and sends this telemetry to the C2. Finally, it receives, decrypts, and executes (`T1105`) the final payload, often injecting it directly into memory (`T1055`) to avoid writing the heavily-signatured ransomware to disk.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends entirely on what the Loader is instructed to download. The primary IoCs are network-based: an unexpected, unsigned executable making beaconing HTTPS connections to unknown, newly registered domains or compromised WordPress sites. Host-based IoCs include EDR alerts for 'Suspicious Process Injection' originating from a file recently downloaded to the `%Temp%` directory.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1566.001",
    "T1105",
    "T1497.001",
    "T1055"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the secondary payload)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Executing the payload in memory)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; the window between a Loader infection and the deployment of ransomware can be less than an hour.",
    "Analyze the network traffic to identify the C2 domains and block them enterprise-wide to prevent the payload download.",
    "Capture a memory dump (RAM) of the running process; this is crucial to extract the decrypted C2 URLs and identify the injected secondary payload.",
    "Investigate the initial delivery vector (e.g., the phishing email) and purge the malicious attachment from all corporate mailboxes."
  ],
  "what_to_avoid": [
    "Do NOT close an incident simply because the initial Loader was quarantined; you must verify in the network logs if the secondary payload was successfully downloaded first.",
    "Avoid relying solely on file deletion, as the injected secondary payload is running entirely in memory."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}