Ecipekac

MITRE ATT&CK: S0624 View on attack.mitre.org

Aliases: HEAVYHAND, SigLoader, DESLoader, Ecipekac

First seen
2019-01-01 00:00:00
Malware type
loader
Family
Malware family
Operating systems
windows
Related IoCs
120 (120 malicious)
Last IoC activity
2026-09-02 03:45:05
Profile updated
2026-07-07 15:30:54

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:jp

Context

Ecipekac is a multi-layer loader that has been used by menuPass since at least 2019 including use as a loader for P8RAT, SodaMaster, and FYAnti.

Recent IoC activity

121 malicious indicators in Maltiverse are attributed to Ecipekac (S0624). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample BSX#24001602.exe 2026-09-02 2
file sample 81994a7037323a0af3b6a703cd888791c43067c0ca15764c9bbf900522079ee7 2026-09-02 2
file sample 7c50044058a5e6ca4e792e2573666f9426abef3f165789024effa1a1966651e5 2026-09-02 3
file sample 7861c46cbb414dbcc6aa51977b94c3532391afa08aaa9907f865e51eb95422b0 2026-09-02 2
file sample 74d52b94dbe44e83459e097ea1a1d22631a78bffa24ccf8ecc5492e9af9091a2 2026-09-01 3
file sample 74d6ad148e3cbc20e9ffdc0a98afb58d4ce813a30966b08d82cbc195535de1fe 2026-09-01 2
file sample 1c6b868bda50a13de084c97460436742b1636b75e60708eeecb9c44d574ccce9 2026-08-30 2
file sample 2f61e87b9efc40e20b2ea6dbd7f304a0cdaacea53c7407bb6da45d2e6302a905 2026-08-28 3
file sample 2e2582850461cb8c5436a1efd3567fb06cd02b46173595fad475db5297c46929 2026-08-28 2
file sample 3fe8f843e696c1dacbdcabed38d7132776915d89b60ac10c68fda048cbfe044f 2026-08-26 2
file sample 2e2b22d80e84945f3149e24fb08a874e5293d4fbbff6d7df7c941fb47be9b4ff 2026-08-26 3
file sample 643a505fefdbf1f0fa9915550a75b2b739aba1683858f92f332c9585c838690d 2026-08-26 2
file sample a1ceb961c3797e6999092bc934714401ac7dd83139223ecc8b5e5b2c08e79c5c 2026-08-25 2
file sample a41339abaddb69089a4fbba54fc00769c123de025a1507d0130a3203fb5d0834 2026-08-25 2
file sample 5c698ae442a9eb13401817b158b8a20f8bf5fe12d38cd7ef1e809ce9cb7a2805 2026-08-25 3
file sample 4b23416ddb5edceb2bcfd5c8b16fc0b739e2d470e69a7c85a033fbbedcac520f 2026-08-24 3
file sample 45965e3993f618a84ee57d7ec7496b65bbfab43edd1652553d801940ebcf598b 2026-08-23 2
file sample 3b0b1b064f6b84d3b68b541f073ddca759e01adbbb9c36e7b38e6707b941539e 2026-08-22 2
file sample 3a66e54745e3455f2a8ecf35cc2ae7f3e4c7f960b547a65a55ac8ee4209b37e4 2026-08-22 3
file sample RFQ678903423_PROD_INQHASUE_de_mexico.exe 2026-08-22 2

Detection coverage

  • 252 Sigma rules

Malware & tools used

  • Obfuscated Files or Information (attack-pattern)
  • Code Signing (attack-pattern)
  • DLL (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)

Used by threat actors

Reports & references

  • MITRE ATT&CK — S0624 (report)
  • Kaspersky — 101519 (report)

External references