Malware

JuicyPotato

As described on the Github repository page, "A sugared version of RottenPotatoNG, with a bit of juice, i.e. another Local Privilege Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM".

Indicators of Compromise 13

Filename MyAppDomainManager.dll Filename PerfWatson2.exe Filename chrome_setup.zip SHA-256 00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c SHA-256 4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d8384 SHA-256 9b481b69cd91b09fa7bae7428f646dd89473a4c03393e43da81fe756cde1c472 SHA-256 cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3 SHA-256 dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87b SHA-256 f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1 IP 139.180.134.221 IP 202.182.102.5 IP 45.32.113.172 IP 45.76.210.43

MITRE ATT&CK TTPs 10

T1003

OS Credential Dumping

Thread Execution Hijacking

System Information Discovery

Exploitation for Credential Access

YARA Detection Rules

JuicyPotato_YARA_Detection

yara ai_generated

rule JuicyPotato_Detection {
    meta:
        description = "Detects JuicyPotato privilege escalation exploit based on behavioral characteristics and known artifacts"
        author = "AI Generated"
        confidence = "high"
        reference = "ATT&CK T1212 - Abuse of Windows Token Manipulation"
        category = "exploit"

    strings:
        $s1 = "CreateService" ascii wide
        $s2 = "OpenSCManager" ascii wide
        $s3 = "SetNamedSecurityInfo" ascii wide
        $s4 = "GetCurrentUser" ascii wide
        $s5 = "NT AUTHORITY\\SYSTEM" ascii wide
        $s6 = "Token Manipulation" ascii wide
        $s7 = "CreateProcessWithToken" ascii wide
        $s8 = "advapi32.dll" ascii wide
        $s9 = "SeDebugPrivilege" ascii wide
        $s10 = "DuplicateToken" ascii wide
        $x1 = "PerfWatson2.exe" ascii wide
        $x2 = "AppDomainManager" ascii wide
        $x3 = "MyAppDomainManager.dll" ascii wide

    condition:
        uint16(0) == 0x5A4D and
        filesize < 100KB and
        (any of ($s*) or all of ($x*)) and
        (pe.imphash() matches {
            "f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1",
            "dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87b",
            "cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3"
        } or
        md5(0, filesize) matches {
            "00e09754526d0fe836ba27e3144ae161",
            "4e1f8888d020decd09799ec946f1bf67"
        })
}

⚠ Rules are AI-generated and unvalidated. Test in a safe environment before production use.

Source Articles

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure

CL-STA-1062, a Chinese-speaking threat actor group active since at least March 2022, has been targeting government entities and critical infrastructure in Southeast Asia. The group, also tracked as UAT-7237, uses a hybrid toolkit combining open-source tools like SoftEther VPN, Mimikatz, and VNT with a custom backdoor named TinyRCT. This backdoor enables command execution, file exfiltration, screen capture, and self-destruction, and is deployed via AppDomainManager injection through a maliciously crafted archive. The campaign demonstrates a sustained regional focus, with attacks spanning from Taiwan to Southeast Asia, particularly targeting energy and government sectors.

unit42 ·1w ago