Procedure examples

Bumblebee has the ability to perform anti-virtualization checks.

Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.

Raspberry Robin contains real and fake second-stage payloads following initial execution, with the real payload only delivered if the malware determines it is not running in a virtualized environment.

IcedID has manipulated Keitaro Traffic Direction System to filter researcher and sandbox traffic.

Pteranodon has the ability to use anti-detection functions to identify sandbox environments.

Bisonal can check to determine if the compromised system is running on VMware.

Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.

RedLine Stealer has an anti-sandbox technique that requires the malware to consistently check with the C2 server, if the communication fails RedLine Stealer will not continue execution.

Black Basta can make a random number of calls to the `kernel32.beep` function to hinder log analysis.

StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.

RTM can detect if it is running within a sandbox or other virtualized analysis environment.

StrelaStealer payloads have used control flow obfuscation techniques such as excessively long code blocks of mathematical instructions to defeat sandboxing and related analysis methods.

Bazar can attempt to overload sandbox analysis by sending 1550 calls to printf.

XLoader can utilize decoy command and control domains within the malware configuration to circumvent sandbox analysis.

Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.

Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.

CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it.

Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.

Kevin can sleep for a time interval between C2 communication attempts.

Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks.

Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.

Gelsemium can use junk code to generate random activity to obscure malware behavior.

Mini Shai-Hulud has evaded sandbox detection by applying a 1-in-6 probability gate that generates a random number which will only trigger the wiper functionality when the set number outcome is met even in environments that match parameters of a geopolitical target.