Malware can behave differently when it senses AV software like sandboxes to evade detection.^[0][1] For example, by modifying its behaviour on detecting interaction with an Antivirus-registered IP,^[2] to which it will send benign content, avoiding detection as malware. Other techniques include fake CAPTCHAS^[3] and stalling.^[4] Having fooled the AV scanner, the malware will then send malicious content to the user. Cloaking can be classified as client-side or server-side.^[2][5]

Sandbox Evasion Synonyms

• Malware Evasion
• Cloaking^[2]

---

Share this article