Ecipekac

SigLoader, also known as DESLoader, Ecipekac, and HEAVYHAND, is a multi-stage Windows malware loader used in targeted intrusion campaigns, particularly those associated with the A41APT cluster and widely linked in public reporting to APT10/menuPass. It is designed to decrypt and execute additional payloads in memory while minimizing on-disk artifacts and evading detection through abuse of legitimate signed software components.

A defining characteristic of SigLoader is its use of DLL side-loading with legitimate executables to launch malicious code. Observed execution chains have abused trusted applications such as policytool.exe and other signed binaries to load a malicious DLL. In multiple cases, SigLoader also abused Microsoft-signed DLLs that had been tampered with by appending or embedding malicious data in areas that do not invalidate Windows signature verification, allowing the files to continue appearing legitimately signed. This technique supports defense evasion by blending malicious content with trusted signed files.

SigLoader operates as a layered loader. It reads encrypted data from a companion file or from embedded regions of a signed DLL, then performs staged decryption and reconstruction of additional loader components and payloads. Reported implementations have used combinations of XOR, custom DES, AES, and in some variants RSA or RC4-related routines. The loader can decrypt multiple PE files and shellcode stages sequentially, culminating in in-memory execution of the final payload. Some variants evolved over time, including changes to encryption identifiers and AES mode selection.

The malware has been used to deliver a range of follow-on payloads, including SodaMaster, P8RAT, FYAnti, xRAT, GreetCake, DelfsCake, Cobalt Strike shellcode or Beacon-related stages, and webshell components such as Jackpot. Several of these payloads are memory-resident or fileless, reinforcing SigLoader’s role as a stealth-oriented staging framework for espionage operations. Associated campaigns have targeted organizations in Japan and overseas branches of Japanese companies, with compromises often beginning through exploitation of internet-facing systems such as SSL-VPN appliances and Microsoft Exchange Server rather than phishing.

SigLoader is best understood as a modular intrusion loader used after initial compromise to establish execution, decrypt embedded stages, and hand off to espionage tooling. Its combination of DLL side-loading, signed-file abuse, staged decryption, and reflective or in-memory payload execution makes it a notable example of defense-evasive loader tradecraft in China-linked cyber-espionage operations.