Loaders, Droppers, and Multi-Stage Payloads

• Modern intrusions are staged — each piece is small and specialized:
• Dropper: writes the next component to disk.
• Loader: pulls and executes the next stage, often in memory (reflective loading, process injection).
• Payload: the real capability (beacon, stealer, ransomware).
• Why stage? Small footprint, swap payloads without redelivery, and separate "get in" from "do damage" to evade detection.
• Common injection tricks: VirtualAllocEx + WriteProcessMemory + CreateRemoteThread, process hollowing, DLL sideloading.