I've been looking into the structure of the online criminal underground, which consists of exploit kits, droppers, and malware payloads.
What is the function of the dropper in this pipeline? Why aren't payloads deployed directly by the exploit kit?
Droppers are a framework for deploying payloads. This is useful for botnets because the bot master can deploy his botnet without a specific payload, then rent out his network to his customers who provide the payload they want.
Crime-as-a-service. Got to love it.