Downloader Trojan

In short: A downloader trojan loads further malware after infection.

In more detail: It is small and inconspicuous so that it evades virus scanners more easily. Its only job: contact a server, download the actual payload (ransomware, infostealer, bot) and start it.

In Depth

Business model

The infection is resold as a service (“loader”). Emotet and Smoke Loader worked this way.

Protection

Block macros, allow scripts only if signed, monitor outgoing traffic, anti-malware with behaviour detection.

See also: Trojans, E-mail Attachments, Botnets