OXLOADER sandbox evasion via WMI Win32_VideoController refresh rate query

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects execution of a WMI query targeting Win32_VideoController to retrieve the CurrentRefreshRate property. This behavior is associated with the OXLOADER malware family, which uses this check to identify sandbox or virtualized environments (typically with refresh rates of 20Hz or lower) and abort execution to evade analysis.