[Buster_BSA]

Hi.

Could someone explain what method uses this malware to notice it is being run under Sandboxie, please?

[wacked2]

I didn't really look because it is VB BUT
It queries the WMI "SELECT * FROM Win32_VideoController"
and aborts on:

Code: Select all

VM Additions S3 Trio32/64
S3 Trio32/64
VirtualBox Graphics Adapter
VMware SVGA II
"\x00"

[Buster_BSA]

I know it has VirtualBox and VMWare detections too, but I am interested in Sandboxie detection method.

Thanks anyway.

[Buster_BSA]

I found the method already. Thanks anyway.