Ecipekac
MITRE ATT&CK: S0624 View on attack.mitre.org
Aliases: HEAVYHAND, SigLoader, DESLoader, Ecipekac
- First seen
- 2019-01-01 00:00:00
- Malware type
- loader
- Family
- Malware family
- Operating systems
- windows
- Related IoCs
- 162 (162 malicious)
- Last IoC activity
- 2026-10-18 03:49:03
- Profile updated
- 2026-07-07 15:30:54
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:jp
Context
Ecipekac is a multi-layer loader that has been used by menuPass since at least 2019 including use as a loader for P8RAT, SodaMaster, and FYAnti.
Recent IoC activity
162 malicious indicators in Maltiverse are attributed to Ecipekac (S0624). The 20 most recently updated:
Detection coverage
- 252 Sigma rules
Malware & tools used
- Obfuscated Files or Information (attack-pattern)
- Code Signing (attack-pattern)
- DLL (attack-pattern)
- Ingress Tool Transfer (attack-pattern)
- Deobfuscate/Decode Files or Information (attack-pattern)
Used by threat actors
- menuPass (threat-actor)
Reports & references
- MITRE ATT&CK — S0624 (report)
- Kaspersky — 101519 (report)
External references
- mitre-attack — S0624
- HEAVYHAND
- SigLoader
- DESLoader
- Securelist APT10 March 2021
- misp-galaxy
- misp-galaxy