We dubbed these downloaders PuppetDownloaders since they are connected to the PuppetLoader malware family, as evidenced by our observations:  This malware and PuppetLoader both use the same string decryption routine that uses the same key.