Grandoreiro's loader decides it is in a sandbox when it finds seven ordinary desktop shortcuts — an inverted environment check, behind a two-hop DLL sideload
Acronis's Threat Research Unit has published a teardown of a Grandoreiro wave whose loader chain is worth reading even for defenders with no Latin American exposure, because the evasion logic runs opposite to the assumption most sandbox-detection countermeasures are built on. Delivery is an archive carrying a renamed copy of Duplicate Files Finder, a legitimate Windows utility. On execution that binary loads its own genuine dependency, and the genuine dependency in turn attempts to load a further library — and it is that second-hop dependency, carrying the ordinary filename of a MinGW runtime component, which has been replaced with the malicious payload (Acronis TRU, 2026-08-19). The camouflage works because a defender or an endpoint product inspecting loaded modules sees a runtime library name with no obvious reason for suspicion, two hops away from the executable that was actually launched. Acronis notes the compile timestamps disagree — the parent utility carries a 2008 timestamp against the implant's 2026 one — while caveating that PE timestamps are trivially forgeable and are corroboration rather than proof. Because the host utility is a windowed application, the implant's first action is to hide the window it would otherwise show.
The environment gate that follows is staged, and one stage is the interesting one. The loader checks that the machine has been up for at least three minutes, profiles memory, processor count, free disk, screen resolution and recently-opened-document history, looks for virtualization driver files and BIOS registry strings, walks a 49-entry blacklist of debuggers, disassemblers and network-analysis processes, performs an IP-geolocation lookup against a short country blacklist, and compares the username and hostname against known default sandbox identifiers. Sitting inside that sequence is a check that inverts the usual reasoning: the loader looks for desktop shortcuts to seven named mainstream applications — a browser set, a cleanup utility, an FTP client, a PDF reader and a messaging client — and if all seven are present simultaneously, it treats the machine as an analysis environment and stops, on the assessment (Acronis's, at moderate confidence) that this exact software bundle fingerprints a particular automated sandbox image rather than a real user's desktop (Acronis TRU, 2026-08-19). A machine that fails the gate is shown a Spanish-language error dialog instead of the payload. Only a host that passes every stage sees the malware resolve its command-and-control address through a public DNS-over-HTTPS resolver rather than the operating system's own resolver, and fetch its next stage over an HTTP request to TCP port 6432 — behaviour Acronis reconstructed from the binary, because the server was offline when it looked.
The hunting value is in the sequence rather than in any single artefact. Acronis's own leads are a renamed copy of that utility loading the runtime-library name from its own directory, and a graphical process that suppresses its own window and then, within moments of launch, queries a public IP-geolocation service and reads the BIOS description keys out of the registry. Triage: the individual actions are all things ordinary software does — installers read hardware information, updaters check geography, plenty of applications ship MinGW runtimes — so no one of them separates malicious from benign. What does is the ordering and the compression: a windowed application that never draws its window, followed inside a few seconds by hardware profiling, a geolocation call and a BIOS registry read, is not doing what the utility whose name it wears is for. The inverted shortcut check is also a warning about analysis tooling itself: a standard, well-stocked analysis image is exactly the fingerprint this family quits on, so a silent non-execution in a sandbox is a result to interpret rather than a clean verdict.
In this campaign, the authors use the legitimate Duplicate Files Finder application but rename it to a randomly generated filename to obscure its purpose. When executed, it first loads another legitimate dependency, dupfdll.dll. This DLL then attempts to load its next dependency, mingwm10.dll, which is not legitimate. In this case, it is a malicious replacement version.
Interestingly, the presence of all of these applications is treated as an indicator of an analysis environment rather than a legitimate user system. If shortcuts for all seven applications are present on the desktop, the malware classifies the system as a sandbox environment and terminates execution.
Unfortunately, the server was offline at the time of our analysis, preventing direct interaction with the C2 infrastructure.
ATT&CK mapping
10 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Execution TA0002
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Stealth TA0005
T1036.005Masquerading: Match Legitimate Resource Name or Location
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
T1140Deobfuscate/Decode Files or Information
Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
T1497.001Virtualization/Sandbox Evasion: System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
T1564.003Hide Artifacts: Hidden Window
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.
T1574.001Hijack Execution Flow: DLL
Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.
Discovery TA0007
T1016System Network Configuration Discovery
Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.
T1057Process Discovery
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
T1082System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
T1497.001Virtualization/Sandbox Evasion: System Checks
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
T1614System Location Discovery
Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Command and Control TA0011
T1071.001Application Layer Protocol: Web Protocols
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.