Advanced malware is becoming more evasive to avoid being detected by analysis sandboxes. Darkhotel uses a huge arsenal of system fingerprints, trying to determine whether it is running inside an analysis environment, and it avoids revealing its malicious behavior if a sandbox is detected. To avoid leaking details about the fingerprints it uses to identify sandboxes, Darkhotel uses just-in-time decryption as well as hashing of strings