malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names if a filename ends with .Md5.exe and if the program is executed from the root of the C:\ drive as well as checks for sandbox-related libraries.(Citation: Lastline DarkHotel Just In Time Decryption Nov 2015)
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names if a filename ends with .Md5.exe and if the program is executed from the root of the C:\ drive as well as checks for sandbox-related libraries.(Citation: Lastline DarkHotel Just In Time Decryption Nov 2015) ### Response: T1497.001.