juicypotato | e2f48ce742bbe7fd4732f94825dadab18e95c53e015743c398e73d32019fe47c

Sharing

Copy URL Twitter E-mail

General

Target
e2f48ce742bbe7fd4732f94825dadab18e95c53e015743c398e73d32019fe47c
Size 352KB
Sample260706-jgblcsbs81
SHA256 e2f48ce742bbe7fd4732f94825dadab18e95c53e015743c398e73d32019fe47c
MD5 508b1748590eecf9b59f662dfbd07a80
SHA1 5be59f2cd7eaac542522df89778f7fc785d9ee33
SHA512 0be1505ecdc9a3804b5b378c4851228b2f5e2ca985a50605037656835ff59a6c8fbe40512ecbafe7cbf22d3c4142381dbf0f6879338919f62ca0c8fe8e1b8154
SSDEEP 6144:vfiHYpLmvYcQcTE3z0D9JBIUPQRfcJrnZqNLVgn+RsEAMp:XPpLmvnY3z0D9JZ7egn+sB
TLSH
T14A747D57B3932CF8C617C07846A7A772E432BA160325FE7F5A84C7332D62E541E79A24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacktool juicypotato

Malware Config

Signatures

Family: JuicyPotato
JuicyPotato is an open-source privilege escalation tool.
hacktool juicypotato

Detects JuicyPotato 1 IoCs

hacktool

resource	yara_rule
sample	family_juicypotato

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e2f48ce742bbe7fd4732f94825dadab18e95c53e015743c398e73d32019fe47c

File Explorer

e2f48ce742bbe7fd4732f94825dadab18e95c53e015743c398e73d32019fe47c

.exe 352KB

e2f48ce742bbe7fd4732f94825dadab18e95c53e015743c398e73d32019fe47c

IMPHASH 59066445cce201cb492c2b79f9366e22
SHA256 e2f48ce742bbe7fd4732f94825dadab18e95c53e015743c398e73d32019fe47c
MD5 508b1748590eecf9b59f662dfbd07a80
SHA1 5be59f2cd7eaac542522df89778f7fc785d9ee33
SHA512 0be1505ecdc9a3804b5b378c4851228b2f5e2ca985a50605037656835ff59a6c8fbe40512ecbafe7cbf22d3c4142381dbf0f6879338919f62ca0c8fe8e1b8154
SSDEEP 6144:vfiHYpLmvYcQcTE3z0D9JBIUPQRfcJrnZqNLVgn+RsEAMp:XPpLmvnY3z0D9JZ7egn+sB
TLSH
T14A747D57B3932CF8C617C07846A7A772E432BA160325FE7F5A84C7332D62E541E79A24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects JuicyPotato

hacktool
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CopySid CreateProcessAsUserW CreateProcessWithTokenW DuplicateTokenEx GetLengthSid GetTokenInformation LookupAccountSidW LookupPrivilegeValueW OpenProcessToken

kernel32

CloseHandle CreateEventW CreateThread DeleteCriticalSection EnterCriticalSection FormatMessageA GetCurrentProcess GetLastError GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetThreadId InitializeConditionVariable InitializeCriticalSection LeaveCriticalSection LocalFree RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte __C_specific_handler

api-ms-win-crt-convert-l1-1-0

mbrtowc strtol strtoll strtoul strtoull wcrtomb wcstombs

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv _cexit _configure_wide_argv _crt_atexit _errno _exit _set_app_type _initialize_wide_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _read fflush fputc fputs fwrite getc setvbuf ungetc

api-ms-win-crt-string-l1-1-0

_wcsicmp isdigit isspace isxdigit mbrlen memset strcmp strlen strncmp strnlen tolower wcscpy wcslen wcsnlen

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CLSIDFromString CoGetInstanceFromIStorage CoInitialize CoTaskMemAlloc CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes

secur32

AcceptSecurityContext AcquireCredentialsHandleW QuerySecurityContextToken

ws2_32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo listen recv select send setsockopt shutdown socket

Name

.text

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e2f48ce742bbe7fd4732f94825dadab18e95c53e015743c398e73d32019fe47c

advapi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

secur32

ws2_32

generic