value:  GoldMax has set an execution trigger date and time stored as an ASCII Unix/Epoch time value. ;; Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API and checking whether the time has been accelerated. ;; Pony has delayed execution using a built-in function to avoid detection and analysis. ;; After initial installation Raindrop runs a computation to delay execution. ;; SUNBURST remained dormant after initial access for a period of up to two weeks. ;; ThiefQuest invokes time call to check the system's time executes a sleep command invokes a second time call and then compares the time difference between the two time calls and the amount of time the system slept to identify the sandbox. ;; Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.
name: Virtualization/Sandbox Evasion: Time Based Evasion