SodaMaster

Malware updated 5 months ago (2024-05-04T19:17:37.656Z)
Download STIX
Preview STIX
SodaMaster, also known as DelfsCake, is a new fileless malware discovered to be another payload of the Ecipekac loader. This sophisticated multi-layer loader module is used to deliver various payloads including SodaMaster, P8RAT (also known as GreetCake and HEAVYPOT), and FYAnti (also known as DILLJUICE stage2) which loads QuasarRAT. SodaMaster employs an original data structure and RSA for its initial communication, subsequently utilizing RC4 for encryption. This malicious software was observed being loaded by HUI Loader alongside other Remote Access Trojans (RATs) such as PlugX, Cobalt Strike, and QuasarRAT. Once inside a system, SodaMaster collects and sends system information such as user_name, host_name, the PID of the malware module, OS_version, and more. The malware's activities are hidden due to its fileless nature, making it challenging to detect and remove. The Chinese threat actor APT 10 exploited a vulnerability in Microsoft Exchange to infiltrate victims' networks, where they deployed a custom loader and the SodaMaster backdoor. This indicates that SodaMaster has been actively used in targeted cyber-espionage operations. With its advanced features and stealthy approach, SodaMaster presents a significant cybersecurity threat.
Description last updated: 2024-05-04T19:14:56.016Z
What's your take? (Question 1 of 1)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Loader
Backdoor
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the SodaMaster Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more