This little ditty can avoid sandboxing on commercial and open stack !

dbit

http://www.infosecurity-magazine.com/news/sleepy-chanitor-variant-sidesteps/

Khannie

Malware's been doing that for a while (though this one does seem quite advanced). It's a real arms race. Interesting times.

dbit

Simple programmatic time waits , now where has this technique been used before , ADT alarms ? Xbox 360 quartz time attack ?? pretty much every thing is open to timing attacks , its just interesting to see how they learned its behavior, in that the sandbox ignored it due to said staggering of time frame on activities . Yes I'm also aware the onion is used quite often to push or hide chatter from cnc or attackers on a plethora of malwares/trojans/ransomwares/pups

Blowfish

It's been a couple of years since malware has been attempting to evade sandboxes through various means. UpClicker was the first I remember which waited for mouse clicks. Other malware does stuff like popping dialogue boxes, multi stage payloads, doing nothing until reboot, checking volume info on the HDD etc..