sandbox-evasion-implement

该技能不是中性的安全研究指南，而是明确帮助 AI 代理实现恶意软件沙箱逃逸与反分析的操作手册；其能力、代码片段和执行流程都服务于在目标环境中隐蔽解密并运行 payload。无明显供应链或凭证转发链，但目的与行为已足以判定为恶意。

该代码是一个反虚拟化、反沙箱和反调试检测框架，具有通过伪造错误隐藏真实行为并在非分析环境执行 payload 的设计。虽然片段本身未显示数据窃取、网络外传或破坏性 payload，但其规避分析和条件执行特征与恶意软件加载器高度一致，应在不可信环境中隔离审查，并重点检查 decrypt_and_execute_payload() 的实现。

This fragment is a highly suspicious anti-sandbox and targeted payload-execution framework. It deliberately detects analysis environments, uses a corporate-domain guardrail, presents a decoy error, and recommends direct syscalls to bypass monitoring before decrypting and executing a payload. No direct data theft or destructive action is visible in the excerpt, but the evasion and gated execution behavior is consistent with malware or a red-team implant. The fragment should not be treated as benign without reviewing the payload and call sites.