> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/cobalt-strike/beacon-payloads.md).

# Beacon Payloads

Most C2 agents are written as a DLL and paired with a loader to load it from memory. What was mentioned, is that there is more than one type of loader.

### Stomped Loader

<figure><img src="https://lwfiles.mycourse.app/66e95234fe489daea7060790-public/eef700639f25153a0886a505ec3492d1.png" alt=""><figcaption></figcaption></figure>

### Prepended loader&#x20;

<figure><img src="https://lwfiles.mycourse.app/66e95234fe489daea7060790-public/04ad699a4088ed58a05cae718c3ce84c.png" alt=""><figcaption></figcaption></figure>

A prepended loader is overall ore stealthy and flexible than a stomped loader. It does not require a shellcode stub to be written over the PE's DOS headers; it can reflectively load any PE; it doesn't require the PE to export any functions necessary for the reflective loading process; and it gives more options to obfuscate the PE. The PE itself can be encoded, encrypted, compresssed, etc. and it will still work as long as the loader knows how to handle those obfuscations.

###