Procedure examples

Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.

QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.

Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis.

CSPY Downloader can search loaded modules, PEB structure, file paths, Registry keys, and memory to determine if it is being debugged or running in a virtual environment.

AsyncRAT can identify strings such as Virtual, vmware, or VirtualBox to detect virtualized environments.

Remcos searches for Sandboxie and VMware on the system.

Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.

Mini Shai-Hulud has evaded execution in virtual environments and sandboxes through checking system information to include the number of CPUs and exiting at times when there were less than four and other times when there were less than two CPUs.

Spark has used a splash screen to check whether an user actively clicks on the screen before running malicious code.

ROAMINGHOUSE can check for specific mouse movements and user activity before initiating malicious activity.

TONESHELL has leveraged `GetForegroundWindow` to detect virtualization or sandboxes by calling the API twice and comparing each window handle.

Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.

The Cobalt Strike loader can use the `MessageBoxA` API to prompt for user interaction as an anti-sandbox measure.

TrickBot has used printf and file I/O loops to delay process execution as part of API hammering.

Bumblebee has the ability to set a hardcoded and randomized sleep interval.

Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.

RansomHub can sleep for a set number of minutes before beginning execution.

The Havoc demon agent can be set to sleep for a specified time.

Pony has delayed execution using a built-in function to avoid detection and analysis.

Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.

Tomiris has the ability to sleep for at least nine minutes to evade sandbox-based analysis systems.

Gootloader can designate a sleep period of more than 22 seconds between stages of infection.

Snip3 can execute `WScript.Sleep` to delay execution of its second stage.

GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.

WhisperGate can pause for 20 seconds to bypass antivirus solutions.

Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.

After initial installation, Raindrop runs a computation to delay execution.

FatDuke can turn itself on or off at random intervals.

DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to measure function timing. DRATzarus can also remotely shut down into sleep mode under specific conditions to evade
detection.

GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.

DarkTortilla can implement the `kernel32.dll` Sleep function to delay execution for up to 300 seconds before implementing persistence or processing an addon package.

Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount() to compare the timing.

Clambling can wait 30 minutes before initiating contact with C2.

SVCReady can enter a sleep stage for 30 minutes to evade detection.

ThiefQuest invokes time call to check the system's time, executes a sleep command, invokes a second time call, and then compares the time difference between the two time calls and the amount of time the system slept to identify the sandbox.

Saint Bot has used the command `timeout 20` to pause the execution of its initial loader.

P8RAT has the ability to "sleep" for a specified time to evade detection.

BendyBear can check for analysis environments and signs of debugging using the Windows API kernel32!GetTickCountKernel32 call.

SodaMaster has the ability to put itself to "sleep" for a specified time.

LiteDuke can wait 30 seconds before executing additional code if security software is detected.

Bazar can use a timer to delay execution of core functionality.

HiddenFace can sleep randomly between 30 and 60 seconds to avoid behavioral analysis.

HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.

SUNBURST remained dormant after initial access for a period of up to two weeks.

EvilBunny has used time measurements from 3 different APIs before and after performing sleep operations to check and abort if the malware is running in a sandbox.

IPsec Helper will sleep for a random number of seconds, iterating 200 times over sleeps between one to three seconds, before continuing execution flow.

GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.

GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.

Clop has used the sleep command to avoid sandbox detection.

Lokibot has performed a time-based anti-debug check before downloading its third stage.