DcRAT Sandbox Evasion via GetTickCount64 and Sleep Timing Checks

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•3

Detects execution of specific malware samples identified as DcRAT that perform environment checks, such as timing analysis using GetTickCount64 and Sleep, combined with system configuration lookups to identify sandbox or analysis environments.