juicypotato | 2026-10-22_da51adfe8c6cb2c738bd6abe033dc66b_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_da51adfe8c6cb2c738bd6abe033dc66b_quasar-rat
Size 988KB
Sample261023-v6522sft4p
SHA256 0d3e22e4b90d8e799d14b4a960eb7a28275460f6e0ef7fa4ce2c7c19428c9dc7
MD5 da51adfe8c6cb2c738bd6abe033dc66b
SHA1 90eb901bd116fc42126ccbce1856159003c5c89d
SHA512 4ee164103a5cbd652a5d68c19b1e8de0d188734832ae3a0bba4249d93464f090d05cfce2b00378f6f935b2cd93b2e2b07d017e1df9916a885c163dade44e2174
SSDEEP 24576:exCXSbiDJF/zbY8ykjC7IjUm33yWpHcpu:eEXt/vnymC79J
TLSH
T17A251A57E26354E8C62FC13487679772BA30B46A42347E6E1A94D7322F30E605F6EB34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

hacktool juicypotato

Malware Config

Signatures

Family: JuicyPotato
JuicyPotato is an open-source privilege escalation tool.
hacktool juicypotato

Detects JuicyPotato 1 IoCs

hacktool

resource	yara_rule
sample	family_juicypotato

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_da51adfe8c6cb2c738bd6abe033dc66b_quasar-rat

File Explorer

2026-10-22_da51adfe8c6cb2c738bd6abe033dc66b_quasar-rat

.exe 988KB

2026-10-22_da51adfe8c6cb2c738bd6abe033dc66b_quasar-rat

IMPHASH ba849945c659b9c96fe6a788e0497a00
SHA256 0d3e22e4b90d8e799d14b4a960eb7a28275460f6e0ef7fa4ce2c7c19428c9dc7
MD5 da51adfe8c6cb2c738bd6abe033dc66b
SHA1 90eb901bd116fc42126ccbce1856159003c5c89d
SHA512 4ee164103a5cbd652a5d68c19b1e8de0d188734832ae3a0bba4249d93464f090d05cfce2b00378f6f935b2cd93b2e2b07d017e1df9916a885c163dade44e2174
SSDEEP 24576:exCXSbiDJF/zbY8ykjC7IjUm33yWpHcpu:eEXt/vnymC79J
TLSH
T17A251A57E26354E8C62FC13487679772BA30B46A42347E6E1A94D7322F30E605F6EB34
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects JuicyPotato

hacktool
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CopySid CreateProcessAsUserW CreateProcessWithTokenW DuplicateTokenEx GetLengthSid GetTokenInformation LookupAccountSidW LookupPrivilegeValueW OpenProcessToken

kernel32

CloseHandle CreateThread DeleteCriticalSection EnterCriticalSection FormatMessageA GetCPInfo GetCurrentProcess GetLastError GetModuleHandleA GetProcAddress GetSystemTimeAsFileTime GetThreadId InitializeConditionVariable InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

msvcrt

iswctype _assert __C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _lock _setmode _unlock _wcsicmp abort atexit calloc exit fflush fprintf fputc fputs free fwrite getenv localeconv malloc memchr memcmp memcpy memmove memset realloc setlocale setvbuf signal strchr strcmp strcoll strcpy strerror strftime strlen strncmp strtoul strxfrm towlower towupper vfprintf wcscoll wcscpy wcsftime wcslen wcsncat wcstombs wcsxfrm _read _fileno

ole32

CLSIDFromString CoGetInstanceFromIStorage CoInitialize CoTaskMemAlloc CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes

secur32

AcceptSecurityContext AcquireCredentialsHandleW QuerySecurityContextToken

ws2_32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo listen recv select send setsockopt shutdown socket

Name

.text

Size

787KB

Virtual Size

786KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_da51adfe8c6cb2c738bd6abe033dc66b_quasar-rat

advapi32

kernel32

msvcrt

ole32

secur32

ws2_32

generic