Payload
The part of malware that carries out its actual harmful action, such as encrypting files, stealing data, or opening a backdoor.
A payload↗ is the part of malware↗ that carries out its actual harmful action once delivered to a target system, distinct from the delivery mechanism, such as a phishing↗ email or exploit↗, that got it there in the first place. A payload might encrypt files for ransom, steal data, open a backdoor↗, or destroy files entirely.
The same delivery method can carry very different payloads, which is why security researchers analyze malware payloads separately from how they arrived, to understand exactly what damage an infection is capable of. Sandboxing suspicious files before execution lets analysts safely observe a payload's behavior without risking a real system.