LokiBot CreateMutex Using MD5 Hash of MachineGuid for Single Instance Check

Duo Tech@duotech

•updated Jun 30, 2026•0•0•0

Detects the LokiBot malware querying the 'MachineGuid' registry value located under 'HKLM\SOFTWARE\Microsoft\Cryptography'. This value is used by the malware to calculate an MD5 hash, which serves as a mutex name to ensure that only a single instance of the malicious process runs on the infected host.