Анализ техник обхода песочниц в малвари

★ 8.4 · security

analyzing-malware-sandbox-evasion-techniques is a Claude Code skill that detects sandbox and VM evasion techniques in malware samples by parsing behavioral reports from Cuckoo Sandbox and AnyRun. It processes JSON report exports, extracts API call sequences, and identifies four evasion categories: timing-based checks (GetTickCount, QueryPerformanceCounter, sleep inflation), VM artifact detection (registry keys, MAC address prefixes, processes such as vmtoolsd.exe), user interaction checks (GetCursorPos, GetAsyncKeyState), and environment fingerprinting (disk size, CPU count, RAM). Output is a structured JSON report with detected techniques, API-level evidence, an evasion sophistication score, and mappings to MITRE ATT&CK T1497 sub-techniques. SOC analysts and malware researchers use it when a sample shows little sandbox activity or when building detection rules for anti-analysis behaviors.