Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 23:41:23 UTC
Home > List all groups > List all tools > List all groups using tool SodaMaster
 Tool: SodaMaster
Names
SodaMaster
DelfsCake
dfls
DARKTOWN
HEAVYPOT
Category Malware
Type Backdoor, Downloader, Loader
Description
(Kaspersky) Another payload of the Ecipekac loader, which we call SodaMaster (a.k.a
DelfsCake), is also a new fileless malware. In our research we found more than 10
samples of SodaMaster. All the collected samples of this module were almost identical,
with the offsets and hex patterns of all functions perfectly matching. The only
differences were in the configuration data, including a hardcoded C2, an encoded RSA
key and additional data for calculating a mutex value.
Information
MITRE ATT&CK Malpedia Last change to this tool card: 30 December 2022
Download this tool card in JSON format
All groups using tool SodaMaster
Changed Name Country Observed
APT groups
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=583bd930-612c-400d-b0c0-ac4ec05023b0
Page 1 of 2

Stone Panda, APT 10, menuPass 2006-Mar 2025
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=583bd930-612c-400d-b0c0-ac4ec05023b0
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=583bd930-612c-400d-b0c0-ac4ec05023b0
Page 2 of 2