Technique
technique:sandbox_evasion
Malware behavior intended to avoid analysis environments by checking whether Arabic language support is installed.
Malware behavior intended to avoid analysis environments by checking whether Arabic language support is installed.
“it’s also a clever way to avoid most sandboxes”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | SharpStage | Explicit | 89 |
SharpStage USES sandbox evasion
SharpStage checks whether Arabic is installed and will not run without it, which Assaf describes as a way to avoid sandboxes.
Explicit Confidence 99% · Assaf Dahan EP 89 Details
“it’s also a clever way to avoid most sandboxes”