A city malware taxonomy chart for new SOC analysts sequences classic delivery stages. Which order correctly reflects dropper, downloader, and payload roles?

Classic malware delivery-stage vocabulary sequences roles by function: a dropper installs or launches helper code already being delivered; a downloader retrieves additional components from the network; a payload performs the adversary’s objective actions (theft, encryption, remote control, and so on). A city malware taxonomy chart for new SOC analysts should present that order so rookies can map evidence—local install/launch, later retrieval, then objective behavior—without treating every malicious EXE as the same label. Clear stage charts improve municipal ticket quality and playbook branching when permitting, finance, or citizen-services hosts show multi-stage activity.

Saying the payload encrypts first, the dropper appears only after ransom payment, and the downloader is optional phishing mail reverses and confuses stages; payment theater is not how dropper taxonomy works. Claiming downloader is always persistence, dropper is always C2, and payload is always the lure document assigns wrong categories to each term. Treating all three labels as synonyms for any malicious EXE erases the pedagogical point of the taxonomy chart.

Exam caveat: real incidents can combine roles in one family, but GOAA still expects the conceptual distinction. Do not reorder stages based on ransomware folklore.

Operational check for city SOC training: when reviewing a case, ask which evidence supports dropper vs downloader vs payload, assign hunt queries to each stage (local write/execute, egress retrieval, objective behaviors), and verify junior analysts can explain why the labels are not interchangeable before they close the learning ticket.