Mutex

What is a mutex

Code and executables download: From GitHub

A mutex (or mutant) is, according to the Microsoft documentation, a synchronization object whose state is set to signaled when it is not owned by any thread and nonsignaled when it is owned.

What this means is that when a program has more than one thread and these threads need to access a shared object (for example, a file or a global variable), each thread might in turn lock the object to prevent the other threads from modifying it. This is often used to avoid race conditions. For example, one thread changes the value of a file while another is reading it. In that case, the reader thread would read an old value rather than the newest one.

Malware can use mutexes for different reasons, for example:

• their intended purpose, as described above,
• to coordinate different threads,
• to avoid reinfection

This discussion focuses on the last point, on why it is used and how it works.

When malware infects a system, it often creates registry entries, scheduled tasks, temporary files, and so on. The infection process can expose the malware to security tools and detection systems, so the fewer times it is performed, the better. Reducing repeated infection attempts can help the malware reduce its observable footprint.