Payload
Definition
The action the malware performs once active: data encryption (ransomware), credential theft (banking trojan), resource hijacking (cryptominer), or system destruction (wiper). The payload defines the harm and the type of evidence the victim needs to preserve.
- Definition scope
- The harmful action malware executes once triggered
- Ransomware payload
- File encryption plus a ransom note
- Trojan payload
- Credential or data theft
- Wiper payload
- Irreversible data or system destruction
- Investigative relevance
- Determines what evidence to prioritise preserving
Common questions
How does the payload differ from the delivery mechanism?+
Delivery is how malware gets onto a system, such as a phishing attachment or a drive-by download, while the payload is what the code does after execution. The same delivery method can carry very different payloads, so investigators analyse both separately.
Why does identifying the payload type change an investigation's priorities?+
A ransomware payload pushes responders toward isolating encrypted volumes and checking backups quickly, while a credential-theft payload shifts priority toward resetting exposed accounts and checking for lateral movement, so misclassifying the payload can waste critical response time.
Can one piece of malware carry more than one payload?+
Yes. Modern malware families often stage multiple payloads, for example stealing credentials before dropping ransomware, so a full static and dynamic analysis is needed rather than stopping at the first observed behaviour.
Related terms
- Carrier (Cover Object)
- The original file, image, audio recording, or video clip used to conceal the hidden message. The modified version containing the hidden data...
- Command and Control (C2)
- The channel through which an attacker sends instructions to malware on a compromised host and receives data back. C2 channels range from...
- Covert Channel
- Any communication path that was not intended by the system designer and that bypasses access-control or monitoring policies. Network covert channels are...
- DCT Coefficient Manipulation
- A transform-domain technique that embeds data in the discrete cosine transform coefficients of a JPEG block, operating within the compressed representation rather...
- Dropper
- A malware component whose sole function is to deliver and install a secondary payload. The dropper itself may be a trojan, a...
- LSB Substitution
- Least-significant-bit substitution: the lowest-order bit of each sample value (pixel colour channel or audio sample) is overwritten with one bit of the...
- Persistence Mechanism
- The technique malware uses to survive a reboot or user logout. Common methods include registry run keys, scheduled tasks, Windows services, cron...
- Propagation Mechanism
- The method by which malware copies itself to new hosts. Viruses attach to host files; worms exploit network services autonomously; trojans rely...
- Rootkit
- Malware designed to hide its own presence by subverting the operating system's reporting functions. User-mode rootkits hook API calls; kernel-mode rootkits modify...
- Steganography
- Concealing one file inside another in a way that hides the existence of the hidden file. LSB image manipulation, JPEG DCT coefficient...
Explained in these topics
- Malware Taxonomy: Viruses, Trojans, Ransomware and More
- Steganography Methods in Images, Audio, and VideoThe secret message or data being hidden. Payload capacity is the amount of data that can be embedded without introducing statistically detectable distortions.