What is a downloader?¶
A downloader is code or a script designed to retrieve additional files or instructions from another location.
Avoid the dangerous assumption¶
The dangerous assumption is that finding a downloader proves the additional malware reached the device.
It does not.
A downloader may contact:
- a web server
- cloud storage
- a compromised website
- an API
- a command-and-control service
- another device on the network.
Investigators should establish:
- whether the downloader executed
- which destination it contacted
- whether the connection succeeded
- what content was requested
- whether content was received
- where it was stored or loaded
- whether the downloaded component executed.
Relevant evidence may exist in process records, command lines, DNS logs, proxy logs, network captures, endpoint telemetry, file creation and memory artefacts.
A connection attempt may fail.
A server may no longer host the payload.
Security tooling may block the download.
The retrieved content may be configuration data rather than executable code.
Do not assume that the destination IP address or domain identifies the offender. The infrastructure may be shared, compromised, rented or relayed.
A downloader may also use legitimate tools such as a browser, command-line utility or scripting engine. The tool itself is not proof of malicious use.
The operational value lies in reconstructing the retrieval chain.
Where downloaded content is no longer available, preserve request paths, response sizes, content types and hashes recorded by security tooling. These may help establish what was retrieved even after the hosting changes.
Operational takeaway¶
Prove execution, network contact, successful retrieval and later use separately before concluding that a downloader delivered additional malware.