type: attack-pattern
spec_version: 2.1
id: attack-pattern--786f488c-cb1f-4602-89c5-86d982ee326b
created: 2019-10-02T14:46:43.632Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1523
external_id: T1523
source_name: Sophos Anti-emulation
description: Chen Yu et al. . (2017, April 13). Android malware anti-emulation techniques. Retrieved October 2, 2019.
url: https://news.sophos.com/en-us/2017/04/13/android-malware-anti-emulation-techniques/
source_name: Xiao-ZergHelper
description: Claud Xiao. (2016, February 21). Pirated iOS App Store’s Client Successfully Evaded Apple iOS Code Review. Retrieved December 12, 2016.
url: http://researchcenter.paloaltonetworks.com/2016/02/pirated-ios-app-stores-client-successfully-evaded-apple-ios-code-review/
source_name: Cyberscoop Evade Analysis January 2019
description: Jeff Stone. (2019, January 18). Sneaky motion-detection feature found on Android malware. Retrieved October 2, 2019.
url: https://www.cyberscoop.com/android-malware-motion-detection-trend-micro/
source_name: ThreatFabric Cerberus
description: ThreatFabric. (2019, August). Cerberus - A new banking Trojan from the underworld. Retrieved September 18, 2019.
url: https://www.threatfabric.com/blogs/cerberus-a-new-banking-trojan-from-the-underworld.html
source_name: Github Anti-emulator
description: Tim Strazzere. (n.d.). Android Anti-Emulator. Retrieved October 2, 2019.
url: https://github.com/strazzere/anti-emulator
source_name: Talos Gustuff Apr 2019
description: Vitor Ventura. (2019, April 9). Gustuff banking botnet targets Australia . Retrieved September 3, 2019.
url: https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:58.965Z
name: Evade Analysis Environment
description: Malicious applications may attempt to detect their operating environment prior to fully executing their payloads. These checks are often used to ensure the application is not running within an analysis environment such as a sandbox used for application vetting, security research, or reverse engineering. 
Adversaries may use many different checks such as physical sensors, location, and system properties to fingerprint emulators and sandbox environments.(Citation: Talos Gustuff Apr 2019)(Citation: ThreatFabric Cerberus)(Citation: Xiao-ZergHelper)(Citation: Cyberscoop Evade Analysis January 2019) Adversaries may access `android.os.SystemProperties` via Java reflection to obtain specific system information.(Citation: Github Anti-emulator) Standard values such as phone number, IMEI, IMSI, device IDs, and device drivers may be checked against default signatures of common sandboxes.(Citation: Sophos Anti-emulation)

kill_chain_phases: kill_chain_name: mitre-mobile-attack
phase_name: defense-evasion
kill_chain_name: mitre-mobile-attack
phase_name: discovery
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: mobile-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Android
iOS
x_mitre_version: 1.0
x_mitre_tactic_type: Post-Adversary Device Access