Nowadays malware sandboxes are commonly used by malware researchers. Sandboxes have also find they place commercially as a new security device. Not surprisingly, As was firewall in the 90’, IPS in early 2K and Web applications firewall recently, they are presented as a new silver bullet security device in the threat detection arsenal of vendors.

Even if it could be very helpful in some cases. It’s not as perfect as vendors claims. Unfortunately, since all protections are subject to countermeasures, bypassing sandbox detection is now a feature commonly seen in malwares and droppers samples. Many sandboxes are nowadays available; Malwr based on open source Cuckoo, other sandboxes rely on closed source; Anubis, Xandora, Commodo or ThreatExpert and finally some commercials ones appears also ; Fireeyes and recently also announced with BlueCoat devices.

We will see common sandboxes detection tricks used in the wild by malware’s dropper. As personal hobby I had studied how malware try to bypass them and I have also found other tricks to bypass some of them. I will details some working tricks. We will finally review some good practices to harden your sandboxes against theses detection.