Another payload of the Ecipekac loader, which we call SodaMaster (a.k.a DelfsCake), is also a new fileless malware. In our research we found more than 10 samples of SodaMaster. The only differences were in the configuration data, including a hardcoded C2, an encoded RSA key and additional data for calculating a mutex value