Published: 2024-02-20 Last Updated: 2024-02-20 07:07:02 UTC by Xavier Mertens (Version: 1) Infostealers written in Python are not new. They also onboard a lot of sandbox detection mechanisms to prevent being executed (and probably detected) by automatic analysis. Last week, I found one that uses the same approach but in a different way. Usually, the scripts have a list of "bad stuff" to check like
![SANS - Internet Storm Center - Cooperative Cyber Threat Monitor And Alert System](https://cdn-ak-scissors.b.st-hatena.com/image/square/ebfdc9054c32b406f061fe47ffd9281d8923007c/height=288;version=1;width=512/https%3A%2F%2Fisc.sans.edu%2Fimages%2Flogos%2Fisc%2Flarge.png)