The payload is the core of the malware. Malware is created for different purposes. Here is a list:

• Malware can steal data such as usernames, passwords, and browser data
• It can steal credentials from the victim's machine
• It can steal banking information
• Malware can download other malware
• Malware can show advertisements to a victim without their consent
• It can act as ransomware

It's not limited to these and there can be many more functionalities. The malware which executes these functionalities is called the payload. A payload is armed with techniques to protect and hide. Finally, before delivery, the malware is packaged with a packer or obfuscator, which adds an extra layer to the sheath to the payload.