# Analyzing Malware Sandbox Evasion Techniques

> Perform analyzing malware sandbox evasion techniques assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

- Skill: `wufufu770/analyzing-malware-sandbox-evasion-techniques` (Agent Skill)
- Install (CLI): `npx skillmds@latest add wufufu770/analyzing-malware-sandbox-evasion-techniques`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/analyzing-malware-sandbox-evasion-techniques/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/analyzing-malware-sandbox-evasion-techniques

---


## TL;DR

- **目的**：Detect sandbox and VM evasion techniques in malware samples by analyzing timing checks, VM/hypervisor artifact queries, user-interaction che…
- **适用**：恶意软件分析/逆向
- **输入**：样本文件/二进制/HASH
- **输出**：漏洞报告/发现清单
- **红线**：样本在隔离沙箱中执行；禁止连接生产网络
- **关联**：上游：003-src-session-start → 下游：071-configuring-oauth2-authorization-flow, 073-hunt-rag-vector, 072-hunt-llm-ai

# Analyzing Malware Sandbox Evasion Techniques

## Quick Start

```bash
# Cuckoo 提交样本
cuckoo submit /path/to/sample.exe
# Cuckoo 查看报告
cuckoo web --url http://localhost:8000
```

## Overview

Sandbox evasion (MITRE ATT&CK T1497) allows malware to detect analysis environments and alter behavior to avoid detection. This skill analyzes behavioral reports from Cuckoo Sandbox and AnyRun for evasion indicators including timing-based checks (GetTickCount, QueryPerformanceCounter, sleep inflation), VM artifact detection (registry keys, MAC address prefixes, process names like vmtoolsd.exe), user interaction checks (mouse movement, keyboard input), and environment fingerprinting (disk size, CPU count, RAM). Detection rules flag samples exhibiting these behaviors for deeper manual analysis.


## When to Use

- When investigating security incidents that require analyzing malware sandbox evasion techniques
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques

## Prerequisites

- Cuckoo Sandbox 2.0+ or AnyRun account for behavioral analysis reports
- Python 3.8+ with json library for report parsing
- Behavioral report exports in JSON format

## Workflow
1. Parse Cuckoo/AnyRun behavioral report JSON files
2. Extract API call sequences for timing-related functions
3. Identify VM artifact detection via registry queries and WMI calls
4. Detect sleep inflation by comparing requested vs actual sleep durations
5. Flag user interaction checks (GetCursorPos, GetAsyncKeyState patterns)
6. Score evasion sophistication based on technique count and diversity
7. Map detected techniques to MITRE ATT&CK T1497 sub-techniques

## Output Format

JSON report listing detected evasion techniques with MITRE ATT&CK mapping, API call evidence, evasion sophistication score, and classification of evasion categories (timing, VM detection, user interaction, environment fingerprinting).
## Workflow

1. **Recon** — Identify authentication mechanisms via `005-analyzing-tls-certificate-transparency-logs` and `017-configuring-tls-1-3-for-secure-communications`
2. **Endpoint discovery** — OAuth flows, SAML endpoints, JWT tokens, session cookies
3. **Token analysis** — Decode JWT, check signature, inspect claims
4. **Auth bypass testing** — Token replay, none algorithm, scope escalation
5. **Verification** — Run `111-fp-check` for cross-tool verification
6. **Documentation** — Fill report template

## Advanced Techniques

### Detect Sandbox via Timing Attacks
```python
import time

start = time.time()
# 执行一些操作
time.sleep(0.001)
elapsed = time.time() - start

if elapsed > 0.5:
    print("Sandbox detected (timing)")
```

### Detect VM via Hardware Fingerprints
```python
import subprocess

# CPUID 指令可检测 VM
if subprocess.run(["grep", "-q", "hypervisor", "/proc/cpuinfo"]).returncode == 0:
    print("VM detected")
```

### Bypass via Long Sleep
```python
import ctypes
# 30 分钟睡眠以绕过沙箱超时
ctypes.windll.kernel32.Sleep(1800 * 1000)
```