AI agents help Joe Sandbox uncover malicious behavior concealed by evasion techniques and unmet execution conditions.
Joe Security‘s Adaptive Detonation brings active intervention to malware analysis, helping security teams investigate threats that may conceal their behavior during an initial sandbox run.
Adaptive Detonation uses AI agents to examine execution results, identify obstacles preventing a sample from revealing relevant behavior, and select targeted interventions. These can include patching a blocking check, creating required files or settings, adjusting the execution environment, or supplying missing command-line arguments.
Joe Sandbox then analyzes the sample again under the modified conditions to verify whether the intervention reveals additional activity.
The approach addresses obstacles including keyboard restrictions, timing checks, firmware-based rejection, date requirements, and missing dependencies. By connecting observed evidence with targeted action and verification, Adaptive Detonation helps analysts investigate why a sample remains inactive and uncover behavior that might otherwise stay hidden.
For security teams, this means deeper visibility into evasive threats and more evidence to support investigations. Adaptive Detonation is available as part of Joe Sandbox AI, a plugin for Joe Sandbox Cloud. Security teams can test Joe Sandbox by signing in or registering for Joe Sandbox Cloud Basic, the free community version.
Read the Adaptive Detonation blog post for technical details, malware case studies, and original and follow-up analysis reports.
About Joe Security
Joe Security is a privately owned Swiss software company founded in 2011 and headquartered in Reinach, Switzerland. It develops malware and phishing analysis technology, combining dynamic analysis, agentic reverse engineering and dedicated analyst lab environments.
VP
Marius Fitigau
info@joesecurity.org