Joe Sandbox v43 - Green Sapphire

We have developed new reports that contain only AI-related information. These reports include AI signature hits and all reasoning texts, providing a clean and focused dataset.

AI Reports serve as the primary source of information for feeding into LLMs. They are also integrated with the recently published Joe Sandbox MCP server, ensuring seamless compatibility and advanced AI-driven analysis.

Recent social engineering attacks that trick users into pasting malicious commands into a shell have become mainstream. Two notable malware families abusing this technique are ClickFix and Fake Captcha.

ClickFix, for example, presents victims with deceptive prompts that encourage them to copy and paste commands into a terminal or console. Once executed, these commands install malware or open the system to further compromise, all without the victim realizing the danger.

With Joe Sandbox v43, we introduced clipboard activity monitoring and automation. This enables Joe Sandbox to detect clipboard modifications and automatically simulate the user actions typically required by such attacks. As a result, these scenarios can now be fully analyzed without requiring any manual interaction, providing deeper visibility and more efficient detection.

Full Analysis Report.

We’re excited to announce our new integration between Microsoft Defender for Endpoint and Joe Sandbox.

The connector automatically collects alerts and evidence from Defender, analyzes them in Joe Sandbox, and enriches alerts with:

• Severity score
• Detection type
• Threat name
• Link to the full analysis