Diaoyu Loader Anti-Sandbox Integrity Check Detection

Ethan Andrews@eandrews

•updated Feb 6, 2026•2•0•37

Detects the creation of a zero-byte 'pic1.png' file alongside an executable in the same directory, a TTP associated with the Diaoyu Loader's anti-sandbox integrity check. This behavior indicates an attempt to evade detection by verifying the execution environment.