reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-loaders-and-droppers/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-loaders-and-droppers	Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or map multi-stage delivery behavior.	cybersecurity	malware-analysis	malware-analysis loader dropper multi-stage delivery	1.0.0	analyst-ai-pack	Apache-2.0	T1105 T1140 T1574	D3-DA D3-FCR	MITRE ATT&CK T1105 Ingress Tool Transfer — https://attack.mitre.org/techniques/T1105/ MITRE ATT&CK T1140 Deobfuscate/Decode Files or Information — https://attack.mitre.org/techniques/T1140/

Analyzing Loaders and Droppers

When to Use

• You have a first-stage loader/dropper and need to find the next stage: an embedded resource, an appended overlay, or a download URL.
• You need to identify the decode/decrypt routine and the execution mechanism (process creation, injection, scheduled task, DLL side-loading).

Do not use this to run the loader and fetch live stages — characterize staging statically and retrieve next stages only in an isolated sandbox.

Prerequisites

• The loader/dropper sample (read inertly).

Safety & Handling

• Read bytes statically; defang download URLs; never execute to pull live payloads.

Workflow

Step 1: Locate staged payloads

python scripts/analyst.py stage sample.bin

Detects embedded PE/archive signatures, an appended overlay beyond the PE's mapped size, large high-entropy blobs, and download URLs.

Step 2: Identify decode/execution mechanism

Scan imports/strings for decode APIs (CryptDecrypt, base64), download APIs (URLDownloadToFile, WinHttp, InternetReadFile), and execution (CreateProcess, ShellExecute, WinExec, side-loading hints).

Step 3: Map the delivery chain

Document stage-1 → decode → stage-2 → execution and map each step to ATT&CK.

Step 4: Defang and report

Defang URLs and produce IOCs for the staging infrastructure.

Validation

• Embedded/overlay stages are confirmed by signature or entropy, with offsets recorded.
• Download URLs and execution mechanism are identified from imports/strings.
• The multi-stage chain maps cleanly to ATT&CK techniques.

Pitfalls

• Treating a benign overlay (installer data, signature) as a payload without corroboration.
• Missing stages fetched at runtime when no URL is in plaintext (obfuscated/encoded).
• Confusing the decode routine for the payload itself.

References

• See references/api-reference.md for the stager.
• ATT&CK T1105 and T1140 (linked in frontmatter).