Sandbox-Aware Malware

Evasive malware detects the sandbox and behaves benignly:

• Sleep / stalling: Sleep(600000) to outlast the analysis time budget.
• VM artifact checks: MAC prefixes, VMware/VirtualBox registry keys, driver names, few CPU cores, small disk/RAM.
• Requires user interaction: only fires after a click, scroll, reboot, or a specific document being opened.
• Environment checks: domain-joined? sandbox usernames? debugger present?