Sandbox evasion is a set of techniques used by malware to detect and avoid analysis in sandbox environments (Cuckoo, Joe Sandbox, Hybrid Analysis, FireEye AX). Sandboxes are isolated virtual environments used by security researchers to analyze malware behavior safely. Malware employs evasion techniques to determine if it's running in a sandbox (virtual machine, debugger, analysis tool) and alters its behavior (sleep, quit, execute benign code) to avoid detection. 70% of modern malware includes sandbox evasion techniques.
Evasion Statistics: 70% of malware samples contain sandbox evasion techniques. 50% of malware delays execution by 5+ minutes to bypass sandbox timeouts. 40% of malware detects virtual machines (VMware, VirtualBox, Hyper-V).
Common sandbox evasion objectives:
Check CPU core count (sandboxes often have 1-2 cores). Check RAM size (< 4GB indicates sandbox). Check for VMware/VirtualBox drivers (vmxnet, vmmouse). Detect hypervisor CPUID leaf (0x40000000).
Malware calls SleepEx() to delay execution. Sandboxes time out after 60-300 seconds. Use anti-sleep techniques: QueryPerformanceCounter to detect time compression. Tools: ApateDNS, Cuckoo time limits.
Check for sandbox-specific files: C:\\agent.pyw (Cuckoo), C:\\analysis.log. Check registry keys: HKLM\\SOFTWARE\\VMware, Inc.\\VMware Tools. Check for low disk space (< 50GB).
Check mouse movement (GetCursorPos). Check for user activity (LastInputInfo). Require mouse click to execute payload. Sandboxes lack human interaction.
Check for analysis tools: Wireshark (wireshark.exe), Procmon (procmon.exe), Process Explorer (procexp.exe), OllyDbg (ollydbg.exe). Detect running VMWare processes (vmtoolsd.exe).
Check for dummy IP ranges (192.168.0.0/16). Detect DNS sinkholes (Cuckoo uses 192.168.0.1). Check for internet connectivity (sandboxes often offline).
// Sandbox detection techniques (malware evasion)
// 1. CPU core count detection (sandbox often 1-2 cores)
SYSTEM_INFO sysInfo;
GetSystemInfo(&sysInfo);
if (sysInfo.dwNumberOfProcessors < 2) {
// Likely sandbox - quit or sleep
}
// 2. RAM detection (sandbox often < 4GB)
MEMORYSTATUSEX memStatus;
GlobalMemoryStatusEx(&memStatus);
if (memStatus.ullTotalPhys < 4 * 1024 * 1024 * 1024) {
// Suspect sandbox
}
// 3. MAC address detection (VMware: 00:0C:29, 00:50:56; VirtualBox: 08:00:27)
GetAdaptersInfo() - check OUI prefix
if (mac[0]==0x08 && mac[1]==0x00 && mac[2]==0x27) {
// VirtualBox detected
}
// 4. Mouse movement detection (sandbox has no cursor movement)
LASTINPUTINFO lii;
GetLastInputInfo(&lii);
if ((GetTickCount() - lii.dwTime) > 60000) {
// No mouse movement for 60 seconds - sandbox
}
// 5. Sleep acceleration detection (sandbox may accelerate time)
QueryPerformanceCounter(&start);
Sleep(5000);
QueryPerformanceCounter(&end);
if ((end.QuadPart - start.QuadPart) < 4000) {
// Time compressed - sandbox detected
}
// 6. Disk size detection (sandbox often small disk)
GetDiskFreeSpaceEx
if (totalBytes < 50 * 1024 * 1024 * 1024) {
// Small disk (<50GB) - sandbox
}
// 7. Running processes detection
if (FindWindow(NULL, "wireshark.exe")) {
// Analysis tool detected - sandbox
}
Malware calls SleepEx(60000) to delay execution for 60 seconds. Sandboxes often limit runtime to 60-300 seconds. Multiple sleep calls can exceed sandbox time limit.
Malware executes benign code for extended period, delays malicious payload until after sandbox timeout. Uses timers (SetTimer) or event loops.
Malware detects time compression (sandboxes accelerate sleep). Compare actual elapsed time vs expected time. If discrepancy > 10%, sandbox detected.
Open-source malware analysis sandbox. Evasion techniques: CPU core detection (single core), low RAM (< 4GB), specific MAC addresses (08:00:27 for VirtualBox).
Advanced sandbox with evasion detection. Monitors sleep calls, environment checks, API hammering.
Enterprise sandbox (Malware Analysis). Evasion: detects VMware/VirtualBox, sleep delays, suspicious API calls.
This demonstration simulates malware detecting sandbox environment and delaying execution:
This is a simulated demonstration. Real malware uses 50+ evasion techniques. Advanced sandboxes must simulate real hardware (CPU cores, RAM, disk size), user interaction (mouse movement), and network activity (live internet) to detect evasion.
Hide hypervisor presence from malware (CPUID leaf 0x40000000). Modify VMware/VirtualBox artifacts (MAC addresses, registry keys, processes). Use nested virtualization.
Extend sandbox runtime to 1-2 hours (bypass long sleep delays). Monitor staggered execution (timers, event loops).
Inject mouse movements (random cursor positions) and keyboard input. Use automation tools (AutoIt, Sikuli) to simulate human behavior.
Simulate 4-8 CPU cores, 8-16 GB RAM, 100+ GB disk. Use real hardware (not virtualization) for gold images.
Best Practice - Realistic Sandbox Configuration: Configure sandboxes with realistic hardware (4-8 CPU cores, 8-16 GB RAM, 100+ GB disk). Hide hypervisor artifacts (VMware/VirtualBox detection). Simulate user interaction (mouse movement, keyboard input). Extend analysis runtime to 1-2 hours. Monitor for sleep delays (SleepEx, QueryPerformanceCounter). Use multiple sandboxes (Cuckoo, Joe, FireEye) to increase detection coverage.
Sandbox evasion techniques are used by malware authors. Security researchers develop sandboxes to detect evasion. Evasion research is ethical when used for defense.
Sandbox evasion research is for defensive purposes only. Deploying evasion in malware is illegal. Penalties include:
Important: This guide is for educational and defensive purposes only. Sandbox evasion techniques help security researchers improve detection.
Open-source sandbox configuration: evasion detection, hypervisor cloaking.
Comprehensive guide: API hammering, process injection, anti-debugging, anti-VM.
Open-source tool testing sandbox evasion techniques (VMware, VirtualBox, Cuckoo).