juicypotato | 2026-10-23_9430a2c9ab06653eb7b3717b7674766b_icedid_juicypotato_juicypototato_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-23_9430a2c9ab06653eb7b3717b7674766b_icedid_juicypotato_juicypototato_njrat_ryuk
Size 340KB
Sample261023-lmcfysxtfw
SHA256 9c48e07a3aa612c5a309b8b29664caa5a52e30faa9be74c884e93461719b9163
MD5 9430a2c9ab06653eb7b3717b7674766b
SHA1 26ff632678547c6372a937e92e576f184aa37613
SHA512 acb44987a755c70de2da0d58ec20a80ba29570ccecc9c7a91a1ac445bf56bf6e9fd708bdd40de0c693b211ee9b82a60761e7e7002b5146ea86947d69e7180a3d
SSDEEP 6144:1fuJYaRk/qxEuUPAVHKZxgHb95dL2f552yxhMsxEc8d7O:1fGFRw3+P/PuiXO
TLSH
T176747C5AF76458F5E977813DC941890BE3B2B8150BB1D78F13A4439E7F232A09D2EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacktool juicypotato

Malware Config

Signatures

Family: JuicyPotato
JuicyPotato is an open-source privilege escalation tool.
hacktool juicypotato

Detects JuicyPotato 1 IoCs

hacktool

resource	yara_rule
sample	family_juicypotato

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-23_9430a2c9ab06653eb7b3717b7674766b_icedid_juicypotato_juicypototato_njrat_ryuk

File Explorer

2026-10-23_9430a2c9ab06653eb7b3717b7674766b_icedid_juicypotato_juicypototato_njrat_ryuk

.exe 340KB

2026-10-23_9430a2c9ab06653eb7b3717b7674766b_icedid_juicypotato_juicypototato_njrat_ryuk

IMPHASH 23867a89c2b8fc733be6cf5ef902f2d1
SHA256 9c48e07a3aa612c5a309b8b29664caa5a52e30faa9be74c884e93461719b9163
MD5 9430a2c9ab06653eb7b3717b7674766b
SHA1 26ff632678547c6372a937e92e576f184aa37613
SHA512 acb44987a755c70de2da0d58ec20a80ba29570ccecc9c7a91a1ac445bf56bf6e9fd708bdd40de0c693b211ee9b82a60761e7e7002b5146ea86947d69e7180a3d
SSDEEP 6144:1fuJYaRk/qxEuUPAVHKZxgHb95dL2f552yxhMsxEc8d7O:1fGFRw3+P/PuiXO
TLSH
T176747C5AF76458F5E977813DC941890BE3B2B8150BB1D78F13A4439E7F232A09D2EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects JuicyPotato

hacktool
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

R:\JuicyPotato\Release\x64\JuicyPotato.pdb

secur32

AcquireCredentialsHandleW QuerySecurityContextToken AcceptSecurityContext

kernel32

Sleep WTSGetActiveConsoleSessionId GetLastError GetCurrentProcess CreateThread LoadLibraryW LoadLibraryExW UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualProtect VirtualFree VirtualAlloc GetVersionExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection WideCharToMultiByte SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount GetProcAddress RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList FreeLibrary DecodePointer ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar GetCommandLineA GetCommandLineW GetACP HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType GetCurrentThread FlushFileBuffers GetConsoleCP GetConsoleMode CloseHandle WaitForSingleObjectEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap SetFilePointerEx WriteConsoleW HeapSize HeapReAlloc CreateFileW CreateTimerQueue SetEvent SignalObjectAndWait SwitchToThread

advapi32

GetTokenInformation CreateProcessAsUserW CreateProcessWithTokenW DuplicateTokenEx OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW LookupAccountSidW CopySid GetLengthSid

ole32

CoTaskMemAlloc CLSIDFromString StgCreateDocfileOnILockBytes CoGetInstanceFromIStorage CoInitialize CreateILockBytesOnHGlobal

ws2_32

freeaddrinfo setsockopt shutdown recv send closesocket bind WSAGetLastError socket WSACleanup getaddrinfo WSAStartup accept select listen __WSAFDIsSet connect

Name

.text

Size

219KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-23_9430a2c9ab06653eb7b3717b7674766b_icedid_juicypotato_juicypototato_njrat_ryuk

secur32

kernel32

advapi32

ole32

ws2_32

generic