One of the first modifications we witnessed in this new variant of BADNEWS is a new mutex that is created to ensure a single instance of BADNEWS is running at a given moment. This malware family used the new mutex ‘com_mycompany_apps_appname_new’. This variant of BADNEWS uses different filenames compared to previous versions. The following filenames are used by BADNEWS throughout its execution