value:  Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names if a filename ends with .Md5.exe and if the program is executed from the root of the C:\ drive as well as checks for sandbox-related libraries. 
name: Virtualization/Sandbox Evasion: System Checks