---
title: Dropper Malware Behavior | Guardsquare
description: Dropper malware is often disguised as a genuine app, with functionalities such as calculators or QR code scanners. Learn more about malware behavior.
---

[![guardsquare-logo](https://insights.guardsquare.com/hs-fs/hubfs/Logos/logo-white.png?length=536&name=logo-white.png "guardsquare-logo") ](https://23593082.hs-sites.com/)

- pricing

[Request Pricing](https://www.guardsquare.com/request-pricing?hsCtaTracking=646b0379-d596-4b1a-8526-2ccbdbb0f81b%7Ce8809087-a83f-4476-8b22-34b9572013fd)

[Login](https://customers.guardsquare.com/login?utm_referrer=https%3A%2F%2Fwww.guardsquare.com%2F)

En

- [中文](https://www.guardsquare.com/zh-hans)
- [한국어](https://www.guardsquare.com/ko)
- [Português](https://www.guardsquare.com/pt-br)
- [Español](https://www.guardsquare.com/es)

# [Mobile Application]

# Security Research Center

 Table of contents

# Dropper applications

The main channel of malware distribution is Google Play Store, where inconspicuous “droppers” apps are uploaded.

Threat actors often disguise these malicious apps as genuine apps, with functionalities such as calculators or QR code scanners.

Once a dropper app is downloaded and run by the unsuspecting user, the malware will be unpacked and loaded onto the device.

![Dropper app screenshot](https://23593082.hs-sites.com/hs-fs/hubfs/knowledge-base-photos/download.webp?width=1170&height=657&name=download.webp)

*Dropper app example - Codice Fiscale, targeting users in Italy*

When malware is installed, it can exhibit more behavioral patterns, such as:

- Downloading modules from a C&C server
- Gain administrator privileges

The main purpose of malware on the device is to perform specific attacks (see the overview).

Proliferation of dropper applications is the primary reason why treating sideloaded apps as apriori malicious and Google Play apps as apriori safe is not a working approach.

## [Guardsquare](https://23593082.hs-sites.com/knowledgebasetest/author/guardsquare)

Connect with the author

** Table of contents **

![HubSpot CMS](https://cdn2.hubspot.net/hubfs/302335/hubspot-cms-logo-gray.svg "HubSpot CMS")

[General Terms](https://23593082.hs-sites.com/terms-of-use) | [Privacy Policy](https://23593082.hs-sites.com/privacy-policy) | [Cookie Policy](https://23593082.hs-sites.com/cookie-policy)

Tervuursevest 362 bus 1, 3000 Leuven, Belgium | VAT: BE0550675829 |

© 2016-2026 Guardsquare nv. All rights reserved.

<https://www.facebook.com/guardsquare> <https://twitter.com/Guardsquare> <https://www.linkedin.com/company/guardsquare/> <https://www.youtube.com/channel/UCP9s5F1ksT1E-7vSF2CDyhw> <https://github.com/Guardsquare>

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Guardsquare",
    "url" : "https://23593082.hs-sites.com/knowledgebasetest/author/guardsquare"
  },
  "dateModified" : "2024-02-28T03:02:03.518Z",
  "datePublished" : "2024-02-13T19:37:17.000Z",
  "headline" : "Dropper Malware Behavior | Guardsquare",
  "mainEntityOfPage" : {
    "@id" : "https://23593082.hs-sites.com/knowledgebasetest/malware/behaviors/dropper",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject"
    }
  }
}
```