Technique:  Virtualization
Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks.
Bazar can attempt to overload sandbox analysis by sending 1550 calls to printf.
Bisonal can check to determine if the compromised system is running on VMware.
Black Basta can make a random number of calls to the kernel32.beep function to hinder log analysis.
Bumblebee has the ability to perform anti-virtualization checks.
Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.
CHOPSTICK  includes runtime checks to identify an analysis environment and prevent execution on it.
Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.
It malware has employed just-in-time decryption of strings to evade sandbox detection.
Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.
Gelsemium can use junk code to generate random activity to obscure malware behavior.
Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.
Kevin can sleep for a time interval between C2 communication attempts.
Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.
During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.
Pteranodon has the ability to use anti-detection functions to identify sandbox environments.
It can detect if it is running within a sandbox or other virtualized analysis environment.
Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.
StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.
Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.
AsyncRAT can identify strings such as Virtual, vmware, or VirtualBox to detect virtualized environments.
Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions.
BadPatch attempts to detect if it is being run in a Virtual Machine (VM) using a WMI query for disk drive name, BIOS, and motherboard information.
Black Basta can check system flags and libraries, process timing, and API's to detect code emulation or sandboxing.
BLUELIGHT can check to see if the infected machine has VM tools running.
Bumblebee has the ability to search for designated file paths and Registry keys that indicate a virtualized environment from multiple products.
CSPY Downloader can search loaded modules, PEB structure, file paths, Registry keys, and memory to determine if it is being debugged or running in a virtual environment.
It malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with .Md5.exe, and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.
DarkTortilla can search a compromised system's running processes and services to detect Hyper-V, QEMU, Virtual PC, Virtual Box, and VMware, as well as Sandboxie.
Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis.
Dyre can detect sandbox analysis environments by inspecting the process list and Registry.
EvilBunny's dropper has checked the number of processes and the length and strings of its own file name to identify if the malware is in a sandbox environment.
It has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.
Ferocious can run anti-sandbox checks using the Microsoft Excel 4.0 function GET.WORKSPACE to determine the OS version, if there is a mouse present, and if the host is capable of playing sounds.
FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.
During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution.
GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to c8:27:cc:c2:37:5a.
Grandoreiro can detect VMWare via its I/O port and Virtual PC via the vpcext instruction.
GravityRAT uses WMI to check the BIOS and manufacturer information for strings like "VMWare", "Virtual", and "XEN" and another WMI request to get the current temperature of the hardware to determine if it's a virtual machine environment.
GuLoader has the ability to perform anti-VM and anti-sandbox checks using string hashing, the API call EnumWindows, and checking for Qemu guest agent.
InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.
Lucifer can check for specific usernames, computer names, device drivers, DLL's, and virtual devices associated with sandboxed environments and can enter an infinite loop and stop itself if any are detected.
macOS.OSAMiner can parse the output of the native system_profiler tool to determine if the machine is running with 4 cores.
MegaCortex has checked the number of CPUs in the system to avoid being run in a sandbox or emulator.
NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.
ObliqueRAT can halt execution if it identifies processes belonging to virtual machine software or analysis tools.
It has used macros to verify if a mouse is connected to a compromised machine.
Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.
OopsIE performs several anti-VM and sandbox checks on the victim's machine. One technique the group has used was to perform a WMI query SELECT * FROM MSAcpi_ThermalZoneTemperature to check the temperature to see if it’s running in a virtual environment.
During Operation Dream Job, It used tools that conducted a variety of system checks to detect sandboxes or VMware services.
OSX_OCEANLOTUS.D checks a number of system parameters to see if it is being run on real hardware or in a virtual machine environment, such as sysctl hw.model and the kernel boot time.
P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.
PlugX checks if VMware tools is running in the background by searching for any process named "vmtoolsd".
PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.
Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.
QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.
Remcos searches for Sandboxie and VMware on the system.
RogueRobin uses WMI to check BIOS version for VBOX, bochs, qemu, virtualbox, and vm to check for evidence that the script might be executing within an analysis environment.
ROKRAT can check for VMware-related files and DLLs related to sandboxes.
Saint Bot has run several virtual machine and sandbox checks, including checking if Sbiedll.dll is present in a list of loaded modules, comparing the machine name to HAL9TH and the user name to JohnDoe, and checking the BIOS version for known virtual machine identifiers.
Shark can stop execution if the screen width of the targeted machine is not over 600 pixels.
Smoke Loader scans processes to perform anti-VM checks.
Snip3 has the ability to detect Windows Sandbox, VMWare, or VirtualBox by querying Win32_ComputerSystem to extract the Manufacturer string.
SodaMaster can check for the presence of the Registry key HKEY_CLASSES_ROOT\Applications\VMwareHostOpen.exe before proceeding to its main functionality.
SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.
SVCReady has the ability to determine if its runtime environment is virtualized.
SynAck checks its directory location in an attempt to avoid launching in a sandbox.
Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.
UBoatRAT checks for virtualization software such as VMWare, VirtualBox, or QEmu on the compromised machine.
It has run system checks to determine if they were operating in a virtualized environment.
WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.
WhisperGate can stop its execution when it recognizes the presence of certain monitoring tools.
yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware.
It has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.
It used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.
Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.
Spark has used a splash screen to check whether an user actively clicks on the screen before running malicious code.
AppleJeus has waited a specified time before downloading a second stage payload.
BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.
Bazar can use a timer to delay execution of core functionality.
BendyBear can check for analysis environments and signs of debugging using the Windows API kernel32!GetTickCountKernel32 call.
Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount() to compare the timing.
Brute Ratel C4 can call NtDelayExecution to pause execution.
Bumblebee has the ability to set a hardcoded and randomized sleep interval.
Clambling can wait 30 minutes before initiating contact with C2.
Clop has used the sleep command to avoid sandbox detection.
Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.
DarkTortilla can implement the kernel32.dll Sleep function to delay execution for up to 300 seconds before implementing persistence or processing an addon package.
DRATzarus can use the GetTickCount and GetSystemTimeAsFileTime API calls to measure function timing. DRATzarus can also remotely shut down into sleep mode under specific conditions to evade detection.
Egregor can perform a  long sleep (greater than or equal to 3 minutes) to evade detection.
EvilBunny has used time measurements from 3 different APIs before and after performing sleep operations to check and abort if the malware is running in a sandbox.
FatDuke can turn itself on or off at random intervals.
GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.
GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.
GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.
GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.
HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.
LiteDuke can wait 30 seconds before executing additional code if security software is detected.
Lokibot has performed a time-based anti-debug check before downloading its third stage.
metaMain has delayed execution for five to six minutes during its persistence establishment process.
Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.
During Operation Dream Job, It used tools that collected GetTickCount and GetSystemTimeAsFileTime data to detect sandbox or VMware services.
P8RAT has the ability to "sleep" for a specified time to evade detection.
Pony has delayed execution using a built-in function to avoid detection and analysis.
The QakBot dropper can delay dropping the payload to evade detection.
After initial installation, Raindrop runs a computation to delay execution.
Saint Bot has used the command timeout 20 to pause the execution of its initial loader.
Snip3 can execute WScript.Sleep to delay execution of its second stage.
SodaMaster has the ability to put itself to "sleep" for a specified time.
StrifeWater can modify its sleep time responses from the default of 20-22 seconds.
SUNBURST remained dormant after initial access for a period of up to two weeks.
SVCReady can enter a sleep stage for 30 minutes to evade detection.
ThiefQuest invokes time call to check the system's time, executes a sleep command, invokes a second time call, and then compares the time difference between the two time calls and the amount of time the system slept to identify the sandbox.
Tomiris has the ability to sleep for at least nine minutes to evade sandbox-based analysis systems.
TrickBot has used printf and file I/O loops to delay process execution as part of API hammering.
Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.
WhisperGate can pause for 20 seconds to bypass antivirus solutions.
Using the machine's local time, XCSSET waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, .report. After the elapsed time, XCSSET executes additional modules.