> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/cobalt-strike/beacon-payloads/prepended-loader.md).

# Prepended loader

Since Cobalt Strike 4.11, Beacon has started using a new style of leader based on the one used by DoublePulsar. This was built by the NSA and leaked by the Shadow Brokers hacker group. The loader is famous for its association with EternalBlue and WannaCry.

This is a 'prepended' loader, which means the loader is prepended to the front of a PE rather than being part of it. The following diagram from Fortra shows the difference betwwen the two loader styles.

<figure><img src="https://images.gitbook.com/__img/dpr=2,width=760,onerror=redirect,format=auto,signature=715162110/https%3A%2F%2Flwfiles.mycourse.app%2F66e95234fe489daea7060790-public%2F04ad699a4088ed58a05cae718c3ce84c.png" alt=""><figcaption></figcaption></figure>

A prepended loader is overall more stealthy and fliexible than a stomped loader. It does not require a shellcde stub to be written over the PE's DOS headers; it can reflectively load any PE; it doesn't require the PE to export any functions necessary for the reflective loading process, and it gives more options to obfuscate the PE. The PE itself can be encoded, encrypted, compressed, etc, and it will still work as long as the loader knows how to handle those obfuscations.