Let's assume a malware was installed (on a UNIX-based platform) with some social engineering tricks. The original installed code itself may be benign, but the only malicious activity is that the malware connects to a C&C server and retrieves some additional malicious payload. Then, the malware tries to execute the retrieved malicious payload.
What is not quite clear for me is that how that malicious payload is executed? Does it need to be written on a file and then a call to execve be made? Are there other possibilities?