{
  "family": "multidropper",
  "sample_count": 17,
  "category": "trojan_dropper",
  "description": "MultiDropper (tracked across industry threat intelligence platforms as TrojanDropper:Win32/MultiDropper, Dropper.Win32.Multi, and Trojan.MultiDropper) is an intricate multi-stage dropper and malware bundling framework designed to deliver multiple distinct threat components in a single intrusion. Unlike simple loaders that fetch payloads over the network, MultiDropper embeds multiple encrypted binaries directly inside its Portable Executable (PE) resource sections (.rsrc) or overlays. Upon execution on the victim host, MultiDropper executes dynamic unpacking routines, verifies administrator privileges, and sequentially drops specialized tools: a kernel rootkit to disable endpoint protection, a credential stealer to extract browser passwords, an HTTP/SOCKS proxy module for external traffic routing, and a persistent backdoor for interactive access. It writes these files into `%SystemRoot%\\System32`, `%TEMP%`, or `%ProgramData%`, modifies discretionary access control lists (DACLs) to hinder deletion, and installs corresponding autostart service entries before terminating its own dropper stub.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "TrojanDropper:Win32/MultiDropper",
    "Dropper.Win32.Multi",
    "Win32/MultiDropper",
    "MultiDropper Framework",
    "Trojan.MultiDropper"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is TrojanDropper:Win32/MultiDropper?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "MultiDropper is a multi-payload trojan dropper that extracts, decrypts, and installs multiple independent malware components simultaneously."
      }
    },
    {
      "@type": "Question",
      "name": "Where does MultiDropper store its embedded malware payloads?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It stores payloads encrypted inside its binary resource (.rsrc) sections, decompressed only in-memory prior to disk extraction."
      }
    },
    {
      "@type": "Question",
      "name": "What typical modules are bundled inside MultiDropper packages?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bundles frequently contain kernel-level rootkits, credential harvesters, traffic proxies, and persistent remote shells."
      }
    },
    {
      "@type": "Question",
      "name": "How does MultiDropper defend against file deletion?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies file permissions via icacls/DACL adjustments and locks files using active driver services or injects them into system processes."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended response procedure for a MultiDropper alert?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform complete host forensic triage because multiple independent malware variants will have been deployed across system directories."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1140",
    "T1547.001",
    "T1543.003",
    "T1222.001",
    "T1055",
    "T1070.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1497.001",
      "name": "Virtualization/Sandbox Evasion: System Checks",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; the machine is actively being compromised by multiple, independent threat actors.",
    "Assume all local credentials and session tokens have been stolen, as an infostealer was likely part of the dropped payload.",
    "Perform a deep forensic scan of `%Temp%`, `%AppData%`, and `C:\\ProgramData` to locate all the disparate executables dropped by the initial container.",
    "Due to the sheer volume of disparate malware dropped and the multiple overlapping persistence mechanisms established, a clean OS rebuild is the only secure remediation path."
  ],
  "what_to_avoid": [
    "Do not attempt manual cleanup; if you miss even one of the dropped payloads (e.g., you remove the miner but miss the RAT), the endpoint remains compromised.",
    "Avoid focusing incident response solely on the first payload detected by the AV; a Multidropper guarantees the presence of other, potentially stealthier threats."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - TrojanDropper:Win32/MultiDropper",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=TrojanDropper:Win32/MultiDropper"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-Dropper.Win32 Overview",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-Dropper.Win32/"
    },
    {
      "name": "MITRE ATT&CK - Deobfuscate/Decode Files or Information (T1140)",
      "url": "https://attack.mitre.org/techniques/T1140/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}