Norwegian Honeynet Project | A chapter of The Honeynet Project
Sandbox Data
Version 1.04 - 2006.09.10

SUBMISSIONS   SIGNATURES   FILE NAMES   BOTNETS   IRC   MALWARE-HOSTS   UNKNOWNS   MUTEXES

Mutex statistics

Mutual Exclusion (abbr. Mutex) objects are used in concurrent programming to avoid the simultaneous use of un-shareable resources and to allow multiple threads to share the same resource. Mutexes are used by malware to prevent the same piece of malicious code to infect a machine twice. We're not sure if this information actually can provide some useful statistics, but we'll try and process the data and see if any trends emerge.

Mutex string histogram

List of all collected mutexes

Mutex Count
rxRizzo_v1.3b 56
1AF5A9C700000000E678BD5439397B8A27F6334586E 36
a3b 33
dsn 29
xi4s 24
DCF7D2F70000000071938BA83B50C70EEDD5CEB8984 19
9EC754A200000000FE66D46A39824016BE8058A92B8 17
xi4ss 17
A1C21D0E00000000D6AF099E3B6ED38F9D85D58CED8 17
a3czf 14
C23010970000000005EE0617399022B8F519763A06D 13
rx01 10
Ms2 10
rxRizzo_v1.1b 9
link0907 9
rx10B 9
VIRUS 9
abosel7 8
lion-12.19.05 8
lolato 7
pia2 7
Rob-88 7
trippardo 7
VrXGr8 6
r0xX 6
907665450000000074474769390FDB488068BF69113 6
nzm 6
CD9F82A300000000D4EE5D683AE1FC7575B139AB344 6
3F10E17700000000ED4FAC51393DCDF5204A02AB9AD 6
BoT 6
idksx 6
uout 6
PP 5
shitman11111 5
acxo1oxca 4
XtC 4
GhostBOT 4
gabber 4
[x] 4
xRx 4
92791DB900000000D0F12DB83B18BA6CA7306BD9E39 4
trippa 4
anxpia 4
attt 4
SX-V2 3
xxJaVaxx 3
Always 3
aleks001 3
js 3
Leechbot r1.5b Private 3
b0tss 3
idi 3
922B661A000000009ADECB9D3989EDD76C53FC18C5E 3
roseslut 3
22 2
zzx 2
Norton 2
asshole 2
oz1e 2
1 2
r0x 2
uot2 2
xXx 2
JumpallsNlsTillt 2
st@ch3ndr4th-new-undetected 2
BILLY 2
ploit1 2
idksxg 2
BoT- 2
Mass 2
GhostBOT0.58c 2
uot 2
ammiraglio 2
mattsk3 2
GhostBOT0.58b 2
Aleks Undertow Modded 2
newrelease!:D:DDD 2
a3co1o 2
xxNetBiosHelpeRxx 2
Bot-6 2
priv-lan 2
mzeeooz 2
ED? 2
TData 2
BlackBot 2
xhost 2
D|D| 2
slave 2
Stolen 2
omgwtfhi2uhaxplz!!11111!!!111 2
kizlo 2
aaa 2
id_id_id_bbx_v1.0r1 2
SILLY 2
000o1o000 2
logotenete 2
uterm19-2 2
[ ash Rx-ASN-Priv ] 2
uterm13.2i 2
ad53 1
rxBot-AKMod0.1a 1
reppinpia 1
kala 1
uterm12 1
real shit 1
ot 1
GhostBOT-0.57 1
[Q8pool By MeShal] 1
BotKiller 1
mutexlast-STA-back 1
uterm19 1
ABO 1
mansorbetaf1le 1
[h4rg 1
122705 1
zZz 1
rx-ASN-2 1
eh 1
uterm19.2 1
[NoTrust] 1
Gulet-sncZZmtx_133 1
TI?J??%? 1
INF- 1
pia 1
rtrtGuteearto--sncZZmtx_133 1
uterm20 1
0xFFFFFFFF 1
AsK0 1
sdbot test id - aleks 1
piamatt 1
[Urx M] 1
uterm18 1
garf4n 1
Sondos 1
BaBeZ-s2334 1
ArroW 1
mylittle_idxabababa 1
r0xi1ngdfhgd 1
fxjwqh 1
ida1 1
0C5BFA36000000004F89E2883920BE69609ADE43996 1
major1 1
LSD2 1
moao 1
h4g 1
IceBot v1.1 1
crang 1
Sd 1
[Reall] 1
dczn3t 1
Sh0x 1
SkynetNotice 1
xi5s 1
ak-ftpd 1
major1111 1
beta 1
ass 1
xxAutoMatiCuPDATExx 1
Stat32bin201kthx 1
#3 1
TrinityZ 1
Sweet 1
SaBeR 1
r0x4t3rrxxdxfdxfc 1
o?r.?? 1
leet 1
hxrx 0.2 by h4x. 1
Dream-X 1
fuck_you_norman 1
r0x4t3rrxxccc 1
fqwkljlrlkwerqkw 1
jessie 1
mac1 1
xRpCMoNx 1
Ghost 1
shitman11211 1
ANiME 1
F699750300000000F6534D8C3B0DFFCF926A6A22D5B 1
warde 1
h444g 1
botid 1
sound 1
..::X00VeR::. 1
F@?E 1
xPRiNTSPoOlx 1
u3b3r l33t 1 1
rX-h4x0r 1
xMAPIMailClientx 1
newrx 1
xNeTDDEsrVx 1
NoTrust 1
[?] 1
scast 1
BuTT 1
new 1
GueSs Who! 1920 1
GangstasRule 1
Bot-7 1
pz 1
mylittle_idxaa 1
GurL Stuff 1
MSsec32 1
[Ruff] 1
BaBeZ-sdpnp 1
lOjPq 1
? 1
shit 1
Y&T 1
v1rg1n 1
OG2 1
ids 1
l9q 1
MArian0z pv8 1
rizzo_mod_v1 1
enigma 1
0xFAFFAFFF 1
xSpOoLx 1
SysFirewall 1
piabot-2 1
m0d 1
masets 1
xxDfrgfat32xx 1
WOWWWWW 1
xrXmz0d-N2ls 1
combo 1
suprem1 1
RALF781D7CA 1
WeLcoMe 1
rs 1
[lord-x] 1
boob 1
zuz 1
uterm17 1
DC0M135 1
this is backup shit 1