Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1633.001: System Checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behavior after checking for the presence of artifacts indicative of a virtual environment or sandbox. If the adversary detects a virtual environment, they may alter their malware’s behavior to disengage from the victim or conceal the core functions of the implant. They may also search for virtualization artifacts before dropping secondary or additional payloads.

Checks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size.

Hardware checks, such as the presence of motion sensors, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.

MobileT1633.001Sub-techniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

System Checks is mobile malware behavior where an app looks for signs it is running in an emulator, sandbox, or analysis environment before revealing its real functionality. For leaders, the practical issue is assurance: automated mobile app vetting can miss malicious behavior if the test environment looks unrealistic.

Executive priority

Prioritize this where Android or iOS devices support sensitive workflows, identity access, banking/payment activity, executive communications, or field operations. The business question is whether mobile security controls can evaluate suspicious apps in realistic conditions and produce evidence for incident response, audit, and risk decisions—not just whether an app was scanned once.

Technical view

ATT&CK lists Android and iOS platforms and no specific tactic or official detection text. Validate coverage against the related detection strategy DET0625 and the parent technique Virtualization/Sandbox Evasion. SOC and IR teams should look for apps that query environment indicators such as host or domain properties, network traffic patterns, network adapter addresses, CPU core count, memory or storage size, and sensor readings such as motion data, especially when those checks appear to gate payload delivery or change app behavior. Relationship context shows this behavior is documented across multiple Android malware entries, including banking trojans, RATs, spyware, adware, and related mobile threats, so Android telemetry depth is especially important.

Likely telemetry

  • Mobile threat defense or mobile EDR alerts and behavioral traces
  • MDM/UEM app inventory, install source, device posture, and compliance state
  • Mobile sandbox or dynamic analysis logs showing system property, hardware, network, and sensor queries
  • Static analysis results for emulator, sandbox, hardware, sensor, and environment-checking code paths
  • Network telemetry from mobile devices or analysis environments

Detection direction

  • Confirm that mobile analysis environments expose realistic device properties, storage, memory, network, and sensor activity; weak sandboxes may cause malware to hide.
  • Tune detections for suspicious combinations of system, hardware, network, and sensor checks followed by behavioral changes, rather than treating every hardware query as malicious.
  • Account for false positives: legitimate apps may check CPU, memory, storage, network state, or sensors for performance and feature support.
  • Compare behavior between sandbox/emulator and real-device analysis where legally and operationally appropriate.
  • Use ATT&CK relationship context to test against known mobile malware patterns, while avoiding assumptions that any single check proves compromise.

Mitigation priorities

  • Strengthen mobile app vetting with dynamic analysis that simulates realistic devices, networks, and sensor activity.
  • Use MDM/UEM policy to limit untrusted app sources and maintain app inventory and device compliance evidence.
  • Prioritize mobile threat monitoring for devices handling sensitive identity, financial, executive, or operational workflows.
  • In incident response, preserve app samples, device context, install source, permissions, network activity, and analysis-environment results for repeatable evidence.
  • Review mobile security testing procedures so sandbox-evasion findings drive escalation rather than a simple pass/fail result.
Analyst notes and limits

This object is a sub-technique of T1633 Virtualization/Sandbox Evasion and supersedes revoked technique T1523. The supplied relationships include one detection strategy, one group, and multiple software entries, mostly Android, that use this behavior. That supports treating it as a material mobile analysis and detection-resilience concern, not as proof of current activity in any environment.

MITRE provides no official detection text and no tactic value for this object. Local conclusions require organization-specific mobile telemetry, app inventory, sandbox design, and device-use context. The supplied fields support Android and iOS platform relevance, but most named software relationships provided are Android-focused.

Official MITRE ATT&CK definition

System Checks

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behavior after checking for the presence of artifacts indicative of a virtual environment or sandbox. If the adversary detects a virtual environment, they may alter their malware’s behavior to disengage from the victim or conceal the core functions of the implant. They may also search for virtualization artifacts before dropping secondary or additional payloads.

Checks could include generic system properties such as host/domain name and samples of network traffic. Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size.

Hardware checks, such as the presence of motion sensors, could also be used to gather evidence that can be indicative a virtual environment. Adversaries may also query for specific readings from these devices.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
Domain ID Name Relationship / procedure
Mobile T1633 Virtualization/Sandbox Evasion This object subtechnique of Virtualization/Sandbox Evasion.
Mobile T1523 Evade Analysis Environment Evade Analysis Environment revoked by this object.
Associated objects

Groups, software, and campaigns

Group Mobile

G0112: Windshift

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.[1][2][3]

Malware Mobile

S1061: AbstractEmu

AbstractEmu is mobile malware that was first seen in Google Play and other third-party stores in October 2021. It was discovered in 19 Android applications, of which at least 7 abused known Android exploits for obtaining root permissions. AbstractEmu was observed primarily impacting users in the United States, however victims are believed to be across a total of 17 countries.[1]

Android
Malware Mobile

S0301: Dendroid

Dendroid is an Android remote access tool (RAT) primarily targeting Western countries. The RAT was available for purchase for $300 and came bundled with a utility to inject the RAT into legitimate applications.[1]

Android
Malware Mobile

S0485: Mandrake

Mandrake is a sophisticated Android espionage platform that has been active in the wild since at least 2016. Mandrake is very actively maintained, with sophisticated features and attacks that are executed with surgical precision.

Mandrake has gone undetected for several years by providing legitimate, ad-free applications with social media and real reviews to back the apps. The malware is only activated when the operators issue a specific command.[1]

Android
Malware Mobile

S0423: Ginp

Ginp is an Android banking trojan that has been used to target Spanish banks. Some of the code was taken directly from Anubis.[1]

Android
Malware Mobile

S0544: HenBox

HenBox is Android malware that attempts to only execute on Xiaomi devices running the MIUI operating system. HenBox has primarily been used to target Uyghurs, a minority Turkic ethnic group.[1]

Android
Malware Mobile

S1083: Chameleon

Chameleon is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, Chameleon has been observed targeting users in Australia and Poland by masquerading as official applications. A new variant of Chameleon has expanded its targets to include Android users in the United Kingdom and Italy.[1][2]

Android
Malware Mobile

S0480: Cerberus

Cerberus is a banking trojan whose usage can be rented on underground forums and marketplaces. Prior to being available to rent, the authors of Cerberus claim was used in private operations for two years.[1]

Android
Malware Mobile

S0411: Rotexy

Rotexy is an Android banking malware that has evolved over several years. It was originally an SMS spyware Trojan first spotted in October 2014, and since then has evolved to contain more features, including ransomware functionality.[1]

Android
Malware Mobile

S0509: FakeSpy

FakeSpy is Android spyware that has been operated by the Chinese threat actor behind the Roaming Mantis campaigns.[1]

Android
Malware Mobile

S0422: Anubis

Anubis is Android malware that was originally used for cyber espionage, and has been retooled as a banking trojan.[1]

Android
Relationship explorer

All related ATT&CK context

uses · Malware S1061: AbstractEmu Mobile subtechnique of · Technique T1633: Virtualization/Sandbox Evasion Mobile uses · Malware S0525: Android/AdDisplay.Ashas Mobile uses · Malware S0301: Dendroid Mobile uses · Malware S0485: Mandrake Mobile uses · Malware S0423: Ginp Mobile uses · Malware S0544: HenBox Mobile uses · Malware S1083: Chameleon Mobile uses · Malware S0545: TERRACOTTA Mobile uses · Group G0112: Windshift Mobile uses · Malware S0480: Cerberus Mobile uses · Malware S0411: Rotexy Mobile uses · Malware S0509: FakeSpy Mobile uses · Malware S0422: Anubis Mobile uses · Malware S1094: BRATA Mobile uses · Malware S0489: WolfRAT Mobile detects · Detection Strategy DET0625: Detection of System Checks Mobile revoked by · Technique T1523: Evade Analysis Environment Mobile uses · Malware S0427: TrickMo Mobile
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
d1f41ac3c5ff3c81...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle d1f41ac3c5ff…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    mitre-attack T1633.001
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use