How Malware Generates Mutex Names to Evade Detectionby Michael Boman

Lenny Zeltser talks about TreasureHunter (md5: 070e9a317ee53ac3814eb86bc7d5bf49), that uses the Windows Product ID to generate the mutex used to verify if the host has already been infected or not. Why is this a problem? Well, each infection generates a different mutex for your Indicators Of Compromise (IOC).

Do read the whole story over at the ISC Diary How Malware Generates Mutex Names to Evade Detection.

Published 09 March 2015