Joe Security (Joe Sandbox)

No entries match these filters. Clear filters

1. The Sandbox That Fights Back: Introducing Adaptive Detonation (2026-11-03) Nov 3, 2026 · issue 130

   Joe Sandbox adds Adaptive Detonation, an AI agent that identifies why a sample stopped, intervenes, and re-runs it to expose hidden malware behavior⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢ ⤢ ⤢ ⤢
   • Joe Sandbox now adds Adaptive Detonation, an AI agent capability that runs a sample, identifies what blocked execution (evasion check, missing prerequisite, or failure), applies a targeted change, and re-analyzes the sample under the new conditions to surface behavior the initial run missed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • The agent can supply missing launch arguments — for example, recovering and injecting the required S1=1 MSI installer property — without modifying the sample package itself.
   • The agent can adjust the analysis environment by setting the guest machine's date to a required window or advancing the guest clock (demonstrated by a two-day advance to bypass a file-age loader delay) before re-running the unchanged sample in Joe Sandbox Cloud.
   • The agent can run preparation code to create required files, directories, or registry values, or install a missing software dependency such as Python in a location the sample already searches.
   • Analysis reports now include the agent's findings from Adaptive Detonation: what blocked execution, the runtime and code evidence, the recommended action, alternative explanations, and remaining uncertainty.

   +1 more show less

   • Adaptive Detonation is available as part of Joe Sandbox AI and has been running in Joe Sandbox Cloud Basic.
   • Joe Sandbox now adds Adaptive Detonation, an AI agent capability that runs a sample, identifies what blocked execution (evasion check, missing prerequisite, or failure), applies a targeted change, and re-analyzes the sample under the new conditions to surface behavior the initial run missed.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • The agent can supply missing launch arguments — for example, recovering and injecting the required S1=1 MSI installer property — without modifying the sample package itself.
   • The agent can adjust the analysis environment by setting the guest machine's date to a required window or advancing the guest clock (demonstrated by a two-day advance to bypass a file-age loader delay) before re-running the unchanged sample in Joe Sandbox Cloud.
   • The agent can run preparation code to create required files, directories, or registry values, or install a missing software dependency such as Python in a location the sample already searches.
   • Adaptive Detonation is available as part of Joe Sandbox AI and has been running in Joe Sandbox Cloud Basic.

   1 more in Everything

2. changelog Sep 15, 2026 · issue 075

   Joe Reverser 2.1 Golden Eagle expands agentic malware and phishing analysis with deeper automation workflow integration.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   ⤢
   • Releases Joe Reverser 2.1 Golden Eagle, an agentic automated analyst covering malware, phishing campaigns, malicious documents, and web-based threats with enhanced autonomous analysis and reverse engineering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Improves integration into automated analysis workflows for Joe Reverser's agentic capabilities.
   • Releases Joe Reverser 2.1 Golden Eagle, an agentic automated analyst covering malware, phishing campaigns, malicious documents, and web-based threats with enhanced autonomous analysis and reverse engineering.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

3. Joe Reverser 2.1 Golden Eagle (2026-09-14) Sep 14, 2026 · release notes

   Joe Reverser 2.1 adds automated API/Parallel Mode submission, PDF reports, File Viewer, stealthy browser, and new analysis diagrams.

   • Adds RESTful Web API for submitting samples to Joe Reverser for fully automated background analysis without interactive chat
   • Introduces Parallel Mode to submit the same sample simultaneously to Joe Sandbox (dynamic analysis) and Joe Reverser (agentic reverse engineering)
   • Adds File Viewer in chat mode to inspect and download generated artifacts like unpacking scripts directly from the analysis experience
   • Enables downloadable PDF Reports alongside existing HTML reports for archiving, sharing, and case management
   • Enhances the browser agent with VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. and proxy support to reduce bot-detection interference and improve stealth during phishing investigations

   +1 more show less

   • Adds Analysis Workflow diagram, IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. Relationship Map, and an overview executive snapshot diagram to the analysis report

   6 details in Everything

4. Joe Sandbox v45 - Green Opal (2026-09-07) Sep 7, 2026 · issue 067

   Joe Sandbox v45 adds 625 new signatures, 55 config extractors, 133 SuricataSuricataAn open-source network threat detection engine maintained by the OISF that performs IDS, IPS, and network security monitoring; cyber tools build on it for high-speed packet inspection and rule-based alerting. rules, and improves DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime./QR/Live Interaction analysis.

   ⤢ ⤢ ⤢
   • Adds 50 new behavior signatures covering emerging malware families including RatonRAT, REMUS Stealer, EtherHiding, GehennaLocker, PureLogs Stealer, PhantomGate, QuimaRAT, and others.
   • Adds 575 new custom YARA rules to detect ransomware, stealers, RATs, and phishing frameworks.
   • Adds 55 new malware configuration extractors — including ZigClipper, BlakcSee Stealer, Sirius RAT, OverLordRat, CastleRat, WikiKit, PhantomGate, Remus Stealer, SantaStealer, and GenericBot — to automatically extract IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. and family configuration data without manual reverse engineering.
   • Adds 133 new Suricata rules (30 anomaly, 88 malware, 15 phishing) covering CastleRAT, LummaC, LxBase RAT, njRAT, Phoenix Stealer, SilentNet, ErrTraffic v2 ClickFix, EvilTokens, Tycoon2FA, and WikiKit/Sneaky2FA.
   • Updates the underlying Suricata engine to Suricata 8.

   +5 more show less

   • Improves DOM extraction and phishing detection for better visibility into dynamic web content, obfuscated scripts, and redirect-based phishing pages.
   • Improves QR code reader analysis to uncover embedded URLs and data in QR-based phishing samples and documents.
   • Improves Live Interaction responsiveness and performance for smoother manual analyst interaction with analysis machines.
   • Adds macOS shutdown protection to prevent analysis evasion via system shutdown on macOS samples.
   • Improves prevention of VM and analysis system detection techniques used by evasive malware.
   • Adds macOS shutdown protection to prevent analysis evasion via system shutdown on macOS samples.

   9 more in Everything

5. Joe Reverser 1.0.0 Silver Wolf (2026-03-05) Mar 5, 2026 · release notes

   Joe Reverser 1.0.0 introduces Skill Only Mode, Office file analysis, and a Chat Report.

   • Adds Skill Only Mode to guide the agent toward specific objectives without predefined workflows
   • Adds analysis support for DOC/DOCX, XLS/XLSX, and PPT/PPTX file formats

   2 details in Everything

6. Joe Sandbox v44 - Smoke Quartz (2026-01-19) Jan 19, 2026 · release notes

   Joe Sandbox v44 adds SOCKSSOCKSA proxy protocol that relays TCP (and optionally UDP) connections through an intermediary server, letting cyber tools route traffic through a pivot host or anonymizing layer without needing raw network access./HTTP proxy support for phishing evasion, Sentinel integration, and macOS Sonoma/Sequoia

   └──▷ HOW TO FIND IT
   Analyze a phishing URL using residential proxies in Joe Sandbox Cloud Pro to bypass bot detection.
   📍Use the Joe Sandbox Cloud Pro interface to configure proxy settings (SOCKS/HTTP) for the analysis job.
   Send suspicious artifacts from Microsoft Sentinel to Joe Sandbox and ingest the behavioral report back into Sentinel.
   📍Configure the Joe Sandbox connector in Microsoft Sentinel workflows, pointing analysis requests to your Joe Sandbox API endpoint.
   • Added SOCKS / HTTP Proxy Support to Joe Sandbox Cloud Pro to evade IP-based reputation and bot detection during phishing analysis.
   • Added Module Proxy Detection to expose stealthy DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. loading techniques (e.g., proxying kernel32!LoadLibrary via ntdll) used to hide C2 beacons.
   • Added Microsoft Sentinel Integration to push Joe Sandbox analysis results back into Microsoft Sentinel workflows for enriched incident context.
   • Added Support for macOS Sonoma and Sequoia to the macOS analysis environment.

   4 details in Everything