Ecipekac

ATP Sandbox Adv. Heuristics

Description

Ecipekac is a multi-layer loader that the menuPass intrusion set has used since at least 2019 to load tooling such as P8RAT, SodaMaster, and FYAnti.

Stats

First seen: April 2022
Last seen: October 2026

Also known as

DESLoaderSigloader

MITRE ATT&CK techniques

5 techniques across 3 tactics.

TA0005 Stealth

T1027Obfuscated Files or Information
T1140Deobfuscate/Decode Files or Information
T1574Hijack Execution Flow
- T1574.001DLL

TA0011 Command and Control

T1105Ingress Tool Transfer

TA0112 Defense Impairment

T1553Subvert Trust Controls
- T1553.002Code Signing

Associated groups

G0045menuPass

Alert name variants

Alert Name	Engine
Win64.Trojan.DESLoader	ATP Sandbox Adv. Heuristics
Win64.Trojan.Ecipekac	ATP Sandbox Adv. Heuristics
Win64.Trojan.Sigloader	ATP Sandbox Adv. Heuristics

Related families

PUBLOAD QakBot StrelaStealer Cobalt Strike DarkGate

References

attack.mitre.org