Skip to main content

​
What is it?

Payload types are the different kinds of agents that can be created and used with Mythic.

​
Where are they located?

Payload type information is located in the Installed Services page by clicking the headphone icon on the left nav bar. From this initial high-level view, a few important pieces of information are shown:
  • Container status indicates if the backing container is online or offline based on certain RabbitMQ Queues existing or not. This status is checked every 5 seconds or so.
  • The name of the payload type which must be unique
  • Which operating systems the agent supports
  • The container-library and payload-type semantic versions, supported C2 profiles, wrapper compatibility, and build capabilities
To modify the Payload Type itself, you need to modify the corresponding class in the Payload Type’s docker container. This class will extend the PayloadType class.

​
Where can I find more documentation about them?

The documentation container contains detailed information about the commands, OPSEC considerations, supported C2 profiles, and more for each payload type when you install it. From the Payload Types page, you can click the document icon to automatically open up the local documentation website to that agent.

​
Mythic 4.0 build capabilities

The payload builder supports saved, named build-parameter instances alongside saved C2 parameter instances. Build parameters can also expose friendly display names, labeled choices, explicit UI ordering, richer hide conditions, dynamic choices, and schema-driven JSONString editors. Normal payload builders should return output architecture and format as build_metadata. Wrapper payload types declare conditional wrapper_payload_requirements; Mythic uses those records and the wrapper’s selected build parameters to page through only compatible payloads. See Wrapper Compatibility.