Dropper vs packer difference

So malware definitions can be a bit convoluted but generally... wrappers wrap, contain or overlay code embedded within. Example could be a vb6 compiled binary when on execution, runs additional code not compiled in vb6 embedded within it. Packers are programs that pack standalone binaries within while compressing them at the same time, statically obfuscating the malicious code. Example is a rar sfx created with winrar or upx. Binders are programs that take two or more files, and bind them together to great one file. On execution all files are processed in some way by the OS, executable or not. Example would be binding a keygen with a trojan. On execution both the keygen and trojan are executed. Crypters encrypt standalone exes for the purpose of antivirus evasion. They encrypt key sections of code, or all the code, so when statically analyzed, you cant tell what the code will do since itll only be decrypted when executed. Good crypters also keep the majority of code encrypted even during run time in memory. Downloaders are defined by their behavior where on execution, they download and execute the 2nd stage payload. Example could be a 1st stage jar that uses the java runtime and is therefor platform independent. Its job is to detect the type of OS and download the correct 2nd stage to run on that OS. Why didnt they just code the 2nd stage in java or include it in the 1st stage? Many different reasons fit for a different discussion altogether. Droppers are programs that usually drop their 2nd stage to disk in a location hidden somewhere, usually %temp%. The dropped exe is usually hidden within the dropper instead of downloaded. Can a dropper also be a downloader? Yes. Can a crypter also be a packer? Yes. There arent any rules when it comes to malware, other than what the executing OS allows and supports. Most packers, droppers, and crypters are built with the builder and stub method. Basically you have a stub which is usually nothing more than an exe itself. Its job is to perform the actions of unpacking, decrypting, downloading, unbinding or dropping the main payload and customized with other settings. The main payload is usually stored within the stub, commonly in a resource. The builder is a program that generates the stub, takes your payload, processes it in some way depending on the functionality of the stub, and combines the two. For example you would use the builder to configure the settings of the stub like persistence, anti-debugging or anti-vm...etc. It takes that config and inserts it into the stub, usually encrypted in some way. Then, it takes your payload and inserts it into the stub too, like a resource. Your trojan is now built. On execution the stub decrypts the config, processes the payload, usually unpacking or decrypting it from the resource, and executes it. Or instead it could read from the config and download the 2nd stage, acting more like a downloader. Sorry if I missed some stuff but generally this is how todays malware is.