MDS’ Evasion Feature of Anti-sandboxes That Uses Pop-up Windows

AhnLab Security Emergency response Center (ASEC) is monitoring various anti-sandbox tactics to evade sandboxes. This post will cover the rather persistent anti-sandbox technique that exploits the button form of the malicious IcedID Word files and the evasion feature of AhnLab’s MDS which is meant for detecting malicious behavior. An anti-sandbox technique that exploits the button form is contained within the malicious IcedID Word file (convert.dot); however, a 2-step process is required to be done by a user before the malicious …

ahnlab asec center dot emergency evade evasion exploits files icedid malicious malicious behavior malware analysis mds monitoring persistent pop process response sandbox sandboxes security tactics windows word