Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Hunting the Mutex

Summary: Unit 42's analysis of WildFire cloud data found that mutex names are far more consistent than assumed, with over 15% of all collected worms sharing the single mutex 2gvwnqjz. The mutex 2gvwnqjz1 was seen only in malware and tied exclusively to the Net-worm:W32/Allaple family, which has propagated since 2006 and encrypts itself differently each time, leaving only about 20% average SSDeep hash overlap between samples.

What you should know: Allaple's polymorphism defeats file hashes, import hashes, and fuzzy hashing, yet a mutex set at compile time still links its samples - a reminder that your detection stack may be blind to a family that has been reinventing itself since 2006.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related