{
  "family": "dropware",
  "sample_count": 26,
  "category": "trojan_dropper",
  "description": "Dropware (cataloged in antimalware telemetry under signatures including TrojanDropper:Win32/Dropware, Trojan:Win32/Dropware, and Trojan.Dropware) is a stealthy modular trojan dropper and initial access payload extractor active since 2014. Distributed predominantly through phishing emails with macro-enabled document attachments and trojanized keygens, Dropware is engineered to deliver multiple secondary crimeware modules while minimizing forensic footprint. Upon execution, Dropware extracts embedded, XOR-encrypted binary executables and DLLs from its resource section or overlay. It writes the decrypted payloads to system temporary folders (%Temp%, %AppData%) or directly executes them in memory via process hollowing into svchost.exe. Dropware installs persistence for dropped components via Windows Registry Run keys, initiates initial reconnaissance beacons over HTTP/HTTPS, and performs self-deletion via cmd batch scripts to thwart post-incident file recovery.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDropper:Win32/Dropware",
    "Trojan:Win32/Dropware",
    "Trojan.Dropware",
    "Win32/Dropware",
    "TrojanDropper:Win32/Dropware.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDropper:Win32/Dropware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Dropware is a trojan dropper that extracts and executes embedded malicious payloads like info-stealers and ransomware on victim systems."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dropware extract embedded malware payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It extracts encrypted binary blobs from PE resources or overlay data, decrypts them with XOR keys, and writes them to %Temp% or injects into memory."
      }
    },
    {
      "@type": "Question",
      "name": "How does Dropware evade post-infection forensic analysis?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It executes temporary cmd batch scripts to delete its own dropper binary immediately after launching secondary payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How is Dropware distributed to victim computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is delivered through malicious spam emails containing macro-enabled office documents and cracked software keygens."
      }
    },
    {
      "@type": "Question",
      "name": "What defensive measures prevent Dropware infections?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Restrict binary execution in %Temp% and %AppData%, deploy behavioral EDR monitoring, and block macro execution in Office files."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1055.012",
    "T1105",
    "T1070.004",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Macro Documents",
    "Trojanized Software Keygens",
    "Drive-by Download Exploits"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Encrypted Resource Payload Extraction",
    "Process Hollowing into svchost.exe",
    "Registry Autostart Persistence Setup",
    "Self-Deletion via Command Scripts",
    "Host Environmental Fingerprinting"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Dropper)",
      "Batch Self-Deletion Script (.bat)"
    ],
    "network_signatures": [
      "Encrypted HTTP POST beacons transmitting infected endpoint GUID and architecture details",
      "DNS queries for dynamic staging domains"
    ],
    "evasion_techniques": [
      "Extracting payloads in memory to avoid writing unencrypted binaries to disk",
      "Self-deletion using cmd.exe /c del commands upon payload execution"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "15e5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3",
      "26f6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\DropwareAgent",
      "HKCU\\Software\\Dropware"
    ],
    "file_paths": [
      "%Temp%\\dropware_stub.exe",
      "%AppData%\\Dropware\\payload.bin",
      "%LocalAppdata%\\Temp\\drop.bat"
    ]
  },
  "defensive_measures": [
    "Deploy AppLocker or Software Restriction Policies to prevent executable launches from %Temp% and %AppData%",
    "Configure EDR alerts to detect rapid dropper file creation followed by cmd.exe self-deletion",
    "Filter incoming emails to block macro-enabled office attachments and archive files"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDropper:Win32/Dropware",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDropper:Win32/Dropware"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Trojan.Win32.Dropware",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "TrojanDropper:Win32/Dropware.A",
      "TrojanDropper:Win32/Dropware.B"
    ]
  },
  "motivation": "Initial Access Provisioning, Crimeware Staging & Forensic Evasion",
  "sample_hashes": []
}