What is a malware payload?¶
A malware payload is the component or function that performs the intended malicious activity.
Avoid the dangerous assumption¶
The dangerous assumption is that the first malicious file discovered is necessarily the main harmful code.
It may only be the delivery mechanism.
A payload may:
- steal information
- create remote access
- encrypt files
- download additional components
- disable security controls
- capture credentials
- move through the network
- destroy data.
Some malware contains the payload directly. Other malware retrieves, decrypts or creates it later.
Investigators should identify the relationship between:
- the initial file or script
- the process that launched it
- any downloaded or extracted components
- the payload that performed the activity
- later persistence or command-and-control behaviour.
Evidence may include process chains, file creation, memory artefacts, network connections, security detections and analyst findings.
Do not assume that a payload was successfully delivered or executed because a dropper or downloader was present.
A download may have failed.
The security product may have blocked the payload.
The system may have lacked required permissions.
The offender may have chosen not to activate a capability.
Likewise, a payload may execute without leaving a normal file on disk.
Reporting should separate capability from observed behaviour. “The payload was capable of encrypting files” is different from “the payload encrypted these files.”
Where several payloads are present, establish sequence and purpose rather than treating the incident as one undifferentiated malware event.
If the payload depended on configuration or commands from elsewhere, preserve those records as well. The same payload may behave differently depending on the instructions, permissions and environment available.
Operational takeaway¶
Identify which component performed the harmful action and prove delivery, execution and effect separately from the initial malicious file.