Fake 'Intel Driver' Malware Checks for Sandboxes Before Striking

Before it does anything else, the binary looks around. A Win32 executable calling itself Inteldriver.exe — a name chosen to blend into a driver folder or a running-process list rather than draw attention — spends its opening moves probing the machine it has landed on for signs of a sandbox or a debugger. That single behavioural signal, carried by a file that VirusTotal shows 39 of 75 engines flagging as malicious, is the most concrete piece of tradecraft in an otherwise thin batch of 24 file…