<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin-top: 0px; margin-bottom: 0px;">Hello,</div>
<div style="margin-top: 0px; margin-bottom: 0px;"><br>
</div>
<div style="margin-top: 0px; margin-bottom: 0px;">I hope everyone is doing well!</div>
<div style="margin-top: 0px; margin-bottom: 0px;"><br>
</div>
<div style="margin-top: 0px; margin-bottom: 0px;">Below is the entry for today.</div>
<div style="margin-top: 0px; margin-bottom: 0px;"><br>
</div>
<div style="margin-top: 0px; margin-bottom: 0px;">08/17/2021 - Diary entry #328:</div>
<div style="margin-top: 0px; margin-bottom: 0px;"><br>
</div>
</div>
<blockquote style="margin-top:0;margin-bottom:0">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p>In this Daily Diary we will start a new thread, explaining the differences regarding malware types. Downloaders and Droppers are by far the most common malware piece one can stumble upon on the internet.</p>
<p><br>
</p>
<p>Downloaders and Droppers are mostly lightweight files, with the sole purpose of preparing the environment and downloading, or extracting from itself, another piece of malware. Although they are very similar, there is a slight difference between them: Droppers
already have the next stage executable inside itself, while a Downloader must download it from an external URL. Both can be found in a vast variety of file formats, like executables, scripts, office documents, PDFs, Microsoft Installers and even Windows help
files.</p>
<p><br>
</p>
<p>As simple pieces of malware, it's somewhat hard to tie a specific type of Downloader or Dropper to a cybercrime group without the knowledge of the downloaded/dropped threat. One malware family can have several Downloaders/Droppers related, and it's very
common that each campaign of a malware uses a different type to avoid detection.</p>
<p><br>
</p>
<p>Social engineering is very important when spreading this kind of threat. Through phishing pages and spam e-mails, an attacker must convince you to download and execute the malware. This is done either by convincing you that's a trusted piece of software,
as we have seen some even mimicking AntiVirus solutions, or by convincing and e-mail attachment is an important document you must open. So next time you receive an e-mail from an unknown sender with an attachment, beware! It's probably a Downloader or a Dropper.<br>
</p>
</div>
</blockquote>
<p><br>
</p>
<p>Kind Regards,<br>
</p>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<table style="font-size:medium; font-family:"Times New Roman"">
<tbody>
<tr>
<td style="width:180px" align="left">
<table width="120" align="left">
<tbody>
<tr>
<td colspan="3" align="center"><a href="https://www.appgate.com/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="120" height="30" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/logo@2x.png"></a></td>
</tr>
<tr>
<td colspan="3" align="center"> </td>
</tr>
<tr>
<td width="37%" align="center"><a href="https://www.linkedin.com/company/appgate-security/" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="18" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/likedin@2x.png"></a></td>
<td width="28%"><a href="https://twitter.com/AppgateSecurity" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="20" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/twitter@2x.png"></a></td>
<td width="35%"><a href="https://www.youtube.com/channel/UC-8GvxcZbm-R3EJNl8jYjiQ" target="_blank" rel="noopener noreferrer" style="margin:0px"><img style="margin:0px" width="26" height="18" src="https://d3aafpijpsak2t.cloudfront.net/images/Signature/youtube@2x.png"></a></td>
</tr>
</tbody>
</table>
<p style="margin-top:0px; margin-bottom:0px"> </p>
</td>
<td colspan="2" rowspan="2" style="width:350px">
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
<strong>Felipe Tarijon de Almeida</strong><br>
Malware Analyst<br>
<strong>Appgate</strong></p>
<p style="color:rgb(12,12,12); font-size:13px; font-family:Arial,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px">
E:<span style="margin:0px"> <a href="mailto:felipe.tarijon@appgate.com" title="mailto:felipe.tarijon@appgate.com">
felipe.tarijon@appgate.com</a></span><br>
O:<span> </span><span style="margin:0px; background-color:white">+55 11 97467 9549</span></p>
</td>
</tr>
</tbody>
</table>
<br>
</div>
</div>
</div>
</div>
</body>
</html>