Loading malware…
Ecipekac, also known as DESLoader, SigLoader, and HEAVYHAND, is a multi-stage Windows malware loader associated with APT10 and the A41APT cyberespionage campaign targeting Japanese organizations and their overseas branches. It decrypts successive portable executable and shellcode stages and executes payloads directly in memory, reducing disk-based exposure. Delivered payloads include SodaMaster, P8RAT, FYAntiLoader, and Cobalt Strike shellcode; FYAntiLoader can subsequently load xRAT or QuasarRAT.
Ecipekac executes through DLL side-loading using legitimate applications, including Oracle Java Policy Tool and VMware utilities. It can retrieve encrypted payload data from modified Microsoft-signed DLLs whose signatures continue to validate. This technique abuses the exclusion of the PE Certificate Table from Authenticode hash calculations, allowing encrypted data to be stored without invalidating signature verification. Its layered decryption routines include XOR, custom DES, and AES, with implementation changes across variants. Samples also contain anti-analysis junk code and manipulated compilation timestamps.
In A41APT intrusions, Ecipekac was deployed after compromise of internet-facing systems, including exploitation of SSL-VPN vulnerabilities. Attackers established persistence through scheduled tasks that repeatedly launched legitimate applications to side-load the loader. Ecipekac supplies the execution framework for subsequent espionage payloads rather than independently providing their credential-stealing or remote-control capabilities.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
"APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign" is the reference for abuse of Oracle Java Platform SE 8 Policy Tool, policytool.exe.
Distinguish attack campaign that threat actor intrudes via internet-facing system, deploy malware such as SigLoader/Sodamaster...
2-1. DESLoader — Aka. SigLoader ▪ Loader file for DLL Side-Loading and files contain encrypted shellcode and payload. ▪ Decrypt multiple PEs and shellcodes sequentially in multiple stages. ▪ Finally, the payload is executed in memory.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
攻撃者は標的組織への侵入経路として、SSL-VPN製品の脆弱性を悪用後、端末を侵害しSigLoaderを設置していました。
Install malware by using Taskscheduler ... In A41APT campaign, scheduled tasks are favor to be used
Registered a task scheduler that executes a legitimate executable file that loads DESLoader every 15 minutes.
Loader file for DLL Side-Loading and files contain encrypted shellcode and payload.
Install malware by using Taskscheduler ... In A41APT campaign, scheduled tasks are favor to be used
Registered a task scheduler that executes a legitimate executable file that loads DESLoader every 15 minutes.
Install malware by using Taskscheduler ... In A41APT campaign, scheduled tasks are favor to be used
Registered a task scheduler that executes a legitimate executable file that loads DESLoader every 15 minutes.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
Signed DLL with encrypted shellcode ... Legitimate file ... DLL Side-Loading
Loader file for DLL Side-Loading and files contain encrypted shellcode and payload.
その後、復号したペイロードをメモリ領域に展開し実行します。
SigLoaderを利用する攻撃者は、デジタル署名されたDLLファイル内に存在する証明書テーブル(Certificate Table)のサイズを拡張し、そのテーブル内のデータを変更することで、デジタル署名に影響を及ぼさずに、DLLファイルを改ざんしています。
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
Data Encoding: Non-Standard Encoding (T1132.002)
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.