LokiBot CreateMutexW via Hashed API Resolution (Hash 0xcf167df4)

Duo Tech@duotech

•updated Jun 30, 2026•0•0•0

Detects the LokiBot malware attempting to resolve the 'CreateMutexW' API function at runtime using a specific hashed value (0xcf167df4). This technique is used by the malware to prevent multiple concurrent instances from running on the same host, which is a characteristic behavioral pattern for this information stealer.