Operation DragonReturn DcRAT Mutex Check via Global\ShitSetupOn26126k

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the execution of DcRAT in Operation DragonReturn, which uses a specific hardcoded named mutex 'Global\ShitSetupOn26126k' to ensure only a single instance of the malware runs on the infected host. This acts as an execution guardrail to prevent multiple processes from running simultaneously.