Update 2024-12-07
Added a bunch of host names from https://raw.githubusercontent.com/1337cstealer1337/vt-bypass/main/pc_username_list.txt
Update 2020-05-21
Added some user names
Update 2017-12-18
- Added a list of sandbox names from the ‘The Adventures of AV and the Leaky Sandbox’ preso [PDF] by SafeBreach Labs
- Removed ‘wscript.shell’ name that was accidentally added to the list
Old post (2015-08-25)
Analysis of malware often leads to a discovery of anti-sandbox tricks. Many of them rely on long lists of ‘known sandbox computer names’ (i.e. computer network names given to sandboxes) and ‘known sandbox user names’ (i.e. user names for accounts under which sandbox executes samples).
The topic of exploiting sandbox frameworks in order to reveal their secrets is not new and many malware-related forums discuss them in details. In this short post I am dropping a bunch (800+) of host names that are commonly recognized by malware as sandboxish. I gathered it over a couple of years from sample analysis, posts online, my own research on various malware forums and lists I got from other people. There may be certainly errors in this list, but I made any effort possible to ensure it is correct. I do not own any copyright on it, but… lots of work went into it – if you want to use it in a commercial product, courses, slides – at least mention where you got it from. Thanks 🙂
In any case, if you own them, it’s time for randomization, because some malware samples already know them!
05h00Gi0
05KvAUQKPQ
074evbxgva9hgql
093954
0e2e44df465c41a
0m9p60j5w-pc
1-57aa74bec7f14
1281412f6b
141700
1c213c79d1
21zLucUnfI85
25-5f69a00d9b64
333333
3u2v9m8
43By4
4tgiizsLimS
5sIBK
5Y3y73
64F2tKIqO5
675052
6cf004c2543846a
6O4KyHhJXBiR
724536
7DBgdxu
7qts0m12600mtvt
7wjlGX7PjlW4
8LnfAai9QdJR
8Nl0ColNQ5bq
8VizSM
9015045e99a846d
928100
9yjCPsEYIMH
a-think
a113b083ad3342d
a52018701
Abby
abc-dd731ae3a20
abc-win7
abc-xp
abdon
acer-ex
acme-997999da9b
ad-europe-1
adier-pc
adm
adm2
admin
admin-4ee07168e
admin-85a7bf2c3
admin-b2619d2d3
admin-de9cb88bb
admin-pc
administ-722bce
Administrator
adriano
adriano-pc
agnaldo-pc
ahnlab-ffa1203f
ahnlabmds
ailton-pc
alam-wahla-pc
alanwak-pc
alberto-pc
alcimar-suexp
alejandro-pc
alessandra-pc
alessandro-pc
alessandro-pc1
alex-pc
alexandre-pc
alexandro-pc
alexpassamani
alfredo-pc
algo-bddc445bd1
ali
aline-060da2530
alinebarreto-pc
allandsonwesley
alone
amb01
amd
Amy
anaclaudia-win
anderson-pc
andre-pc
andreluiz-pc
andrey-pc
andreza-pc
android
andréluiz-pc
angelarita
angy
anna-client-59
anna-cws311
antonia
antonie
antony
antony-pc
apiary7-pc
AppOnFlySupport
apto44
arachonpc
arlisson-yagami
arthur-pc
asd-vp-test
asim-pc
ASPNET
assistsocial
ast-001
auto
azure
baixajat-906443
bal02
balbino-pc
banco_01
barreto-f3a0ac5
bb-01-14
bb-03-21
bb-04-66
bd-urlsclav6
bd-urlsclav9
benevide-lpix7n
bento-pc
beron
besouro-pc
bespawl
beto
beton-rats1
beton-ratsl
biano
billy
blr1-soumyad-v1
blype
bolacha-pc
borel
br-taylor-87
brbrb-d8fb22af1
brenno-pc
brian-75445f269
briapc
brsao0692
bruna
bruno
bruno-e214bfa09
bruno-pc
brunoefamília
brunoreis
btig-ht
BUiA1hkm
buteri-pc
BvJChRPnsxn
BXw7q
c02tt18
c02tt22
c02tt26
c02tt36
c06tt43
c2f3f0b206c14e9
ca-brian-75
caio-pc
caixa
caixa1
cameras
camila
camp-08-pc
carlosalberto
carlosmello
carol-pc
carolina-pc
carvalho-pc
casa
casa-010a80cf0b
casa-2d7ed3857a
casa-pc
casa29-pc
casaisestaleiro
cat02-pc
cdata
cen_gui_10
cepa-14
cesarmello-pc
cftv
cgjto-005
changeme1
charles-3cccf5a
chintan
christia-51e582
cida-pc
cidb-pc
circumstellar
claudemir-pc
claudia-pc
claudina-pc
claudio-pc
clayton-pc
cleiton-pc
cliente
cliente-1323c95
cliente-2223686
cliente-339673e
cliente-4659bdf
cliente-6c1119d
cliente-cec8e04
cliente-pc
cliente5518830
clientrep-pc
cM0uEGN4do
cmas-73f49570c3
cmdt001
cMkNdS6
cntsm5002
comp
comp-73ac1ec5e6
comp-e87d7c32d1
comp-home261245be
comp10
compaq
computad-ea50a5
computador
computador-pc
computer-pc
computer-xxxxxx
computername
connect-pc
contab-06
coro-pc
corp089120471
cpu-47
crea-6777291f93
cris
cristiano-pc
crux
cssv-lav-melnt
cti-778ee90c19e
ctsandress
cuckoo05-2
cuckoo0801-vm
cuckoo0806-vm
cws01_20
cws02_n29
cws03_28
cws04_27
cws05d205
cws06d208
cws09d002
cws09ex02
cws10d002
cws10d007
cws12d007
cwsandbox
cássio-pc
célia-pc
damiana-pc
daniel-pc
daniela-pc
daniella-hp
daniellemendonç
danilo-pc
dany-pc
david-pc
dbd27012570
DdQrgc
debora-pc
dede-pc
DefaultAccount
dell-c13c53a412
dell-d3e62f7e26
delta
dener-pc
desktop
dh4023xp
dh61ww
dhianinny-pc
diego-pc
diegofelix
digital-pc
dijkstra-b459ad
dinda
diogo-2ef6fca36
dionifer-pc
diva-pc
dnapc
documentos-pc
donato-pc
dono-pc
dooku01
dooku02
douglas-ae6c0b0
dOuyo8RV71
drogaria-pc
drs-pc
dt-103
duda-pc
dudalina-469862
dulcina-sti
DVrzi
dwi-9625ac2e275
dxd8DJ7c
e60UW
ecVtZ5wE
edeilson-pc
ediene
edithpc
edmara-pc
edna-pc
edson-pc
eduardo-pc
eduardo-win
EGG0p
elaine
elaine-pc
elchante
eleanorepc
elelson-pc
eletricista-pc
eli-pc
eliasepaty-pc
eliz
elizange
elvis-pc
emerson
emilia_note
emiliodias-pc
equipo
equipo01
equZE3J
erick
escritorio
escritorio2
esf-748514fd982
especialistas
estagcoordenada
estoque
estudiolf-pc
everson-pc
examplepc
express-860a48f
fa02conpc18
fabiana-mega
fabiana-pc
fabinho-pc
fake
familia-pc
familiacabral
familycruzperez
fanoleoy_dp_ind
faster02
felipe-pc
fenix-pc
fernanda
fernando-pc
figueiredo-pc
fireeye
florianpc
flytour-pc
fNBDSlDTXY
fortinet-5b6acf
Frank
fred
frederick-pc
G2DbYLDgzz8Y
gabbipc
gabriel82497752
gabriela-pc
gabyrodarte
gabyzona-pc
gean-397b7cd2f8
gems-3d59a99f5e
genilson
george
geovane-1551e38
geral-b1c99ac61
gerencia-pc
gerenciador
gerenciageral
GexwjQdjXG
gfi-client
gfi-client5
GGw8NR
gilvan-pc
giseleeronaldo
GJAm1NxXVm
GjBsjb
gL50ksOp
glauco-pc
gordinho
grafica
gt-fdccd9a7405d
gu17B
Guest
guilherme-pc
gunna-pc
gustavo
gustavo-4e92a09
h7dk1xPr
h86LHD
hans
hardxp-test
Harry Johnson
hayandra-pc
hbxpeng
hbyLdJtcKyN1
hd8r2jds87rew82
helder-pc
heloisa-pc
helsapc
heros
HEUeRzl
hmarc
home
home-1afd6d458b
home-6eca5ee0b6
home-off-d5f0ac
home-pc
home1
honey
host-932c51a1d7
hp
hp30512952714
hppavilion-pc
hudson-pc
ice
icec-pc
ICQja5iT
igor-pc
impressora-pc
info-1a42164f8b
infornet-3b9e72
inventarios
ioavm
iracema-pc
isabella-272349
itautec-pc
ivaldo-sti
ivis-pc
IVwoKUF
IZZuXj
j6SHA37KA
j7pNjWM
jaime-pc
janaina-pc
janettedoe
JAW4Dz0
JcOtj17dZx
jeferson-2c60e6
jeff-pc
jessica
jessica-pc
jfserv
jhonata-pc
jhonatas-pc
jhonatta-fc85e2
jhow
joe-
joe-8a81c76c9df
John
john-pc
johnson-pc
jonas-pc
jonatham-pc
jonathan-c561e0
jorge-almeida
joripc
josecarlos01
joseluiz
joseroberto-pc
josicléia-pc
joséadelmo-pc
jp-patricia
juan-pc
juceli-pc
jude
Julia
juliano-pc
julyano-pc
junior-pc
kaik-hp
kamilosoft
kamino
karine-4b483d0c
katorres
kayky
kEecfMwgj
kFu0lQwgX5P
khune-pc
kide-pc
kinho-pc
kl-pc
klone-pc
klone_x64-pc
KUv3bT4
l3cnbB8Ar5b8
lab
lab-fe8333022ab
lailla-pc
lair-lair-pc
lalo
lan04
laptop
larissa-win
lazaro
lecio-pc
lego-02
leh-hp
lemos-pc
lenovo01
leo
leonardo
leonardo-607757
lespino-pzr
lika-pc
lilian-0450a94e
liliane-sti
Lisa
lite
livia-pc
lK3zMR
lmVwjj9b
logatti-0415d02
lopes-pc
Louise
luan-pc
luannarosa-pc
lubi53aN14cU
Lucas
luis
luisbaggio-pc
lula
luser-pc
luziene-pc
léia-pc
m-5842fbb816684
m3
machine_name
magdo-pc
mahmood-pc
majaslam-pc
malekal
malvapc
mamepc
manoel-pc
maq05
maq30-ana
maquina1
maquina10
marcelino
marcelo
marcelo-d936308
marcelo-pc
marcia-pc
marcio-285c334d
marcio-pc
marcosaurelio
marcowillma
mariaeliza-pc
marilene
marineuza-pc
mario-pc
marta
mauro-64217af1b
mauro-ad6cc462b
max
maykemoraes
me-pc
medeiros-pc
melissa-pc
michael-f156cf7
michele
michelleailton
micro-casa
micro-pc
micro004
micro02
micro07
micro20
microsof-3cde6c
microsof-be1a00
mike
miki-pc
milerson
mip-xp-cht
miraely-pc
mirella-tecno
moacir-pc
morte+
mr-computer
Mr.None
mypc
my_pc_home
na-win
nageral-pc
nazareth-pc
nb00023-ar
neide-6950231e6
neila-pc
nelson-pc
neopc
new775
niko-pc
noK4zG7ZhOf
none-dusez58jo1
not-325
note01
note03
noteasus
notebm-pc
notebook
notebook_vika
nova-pc
ntblucas
nunes-pc
nuria
nZAp7UBVaS1
o-92cc2a5742b94
o6jdigq
o8yTi52T
oem-9ecf19511ee
Of20XqH4VL
office-d
oficina03gh
OgJb6GqgK0O
oi-d9cc29398c70
oi-pc
ok-pc
opala-ascnet
orlando-pc
os2019-pc
oscar06
OZFUCOD6
pablo
pabola-ccf85bc5
palmeiras-mega
pan-1e6ecc1f78b
particul-3d9849
particul-c1a251
particul-ec6138
particular-pc
patex
patricia-9mprqb
patriciagurgel
Paul Jones
paulo-pc
paulocesar-pc
pc
pc-05
pc-10-15
pc-1central
pc-2
pc-2423eb1b5d14
pc-4a095e27cb
pc-71cfa7a097c7
pc-7c18ad05454e
pc-aaf7dbdc1907
pc-fffdcbe8f2bd
pc-jp
pc-pc
pc-user
pc0
pc01-camila
pc02
pc06
pc1
pc11545
pc2
pc220-michael
pc4
pc5
pc8
pc9
pcrodrigo
pcsuporte
pcum
pcvista
pcwe
pc_coord02
pedrinho
pedrosa
peixe
perry-pc
personal-pc
pessoal
pessoal-2863f28
pessoal-e151137
pessoal-pc
petraschauff-pc
pf5vj
PgfV1X
pierre-0a6da9db
ping-78a0089269
placehol-6f699a
plat-1df898110e
positivo-ba00dc
PqONjHVwexsS
presidência-pc
professores
pronaf2
public-ea8367e7
pWOuqdTDQ
PxmdUOpVyx
QfofoG
QmIS5df7u
QORxJKNk
quad-pc
quarto
qumica_rita
qZo9A
r-pc
rafael
rafael-pc
raissa-pc
raphaelcosta
rats-pc
rB5BnfuR2
RDhJ0CNFevzX
recepcao6
recepcion
recepção
regina-20130606
reginaldo-pc
replik4tor
residenc-f47065
residencia
reynapc
RGzcBUyrznReg
rh
rh-00
ricardo-pc
rodrigo-pc
rodrigo-vaio
roger-pc
rogeriocapaz
rogeriomaq
rogilene-pc
rogérioejully
ron-ac13bf686b1
root-98563fe0cb
root-9a37cb520d
root-d
rosana-pc
rosesouza-pc
rsa0
rswt-win7-32-00
Rt1r7
ruan-pc
ruizinho
ruth-pc
ryjIJKIrOMs
s3-002
S7Wjuf
sa17-testxp
sacada3
safira1-pc
sal.rosenburg
sala1
salita
salut
sam-nb
samlab
samuel
sanches-pc
sandbox
sandra-mega
sandro
sc14_23
sc15_01
scscs<u)ws##pw
sdd-pc
secgoverno
sec_edu
selda-38a0c09e5
sergio-679a5b36
server
server
servidor
servidor-a546b3
servtec-41daf81
seven-pc
sharaipc
shawl-pc
shawl-vaio
shimelly-fb6099
shimohiro-pc
sidnei-pc
simone-pc
sincoder-b046f9
sincoder-zzzzzz
siraj-hp
smk®
sos-a456b0343ef
soufoda-pc
sp3
spacebr-pc
sportrenie
spurtive
SqgFOf3G
starter-pc
Steve
sti
stop
suene-80951215f
sulene-pc
support
susana-hp
svj03
tadeu-pc
tamires
tata
tatiana-pc
tato-pc
tayeh-pc
tel11s1a0
tequilaboomboom
terminal05
tespc0
tespc09
test
test-2f0ddd7e5f
test-pc
tester
testpc0
thatiane-pc
tHiF2T
thorsten-f495f3
tiaguinhoo-pc
time6
titan
traxpall
TVM
tvmcom
txWas1m2t
tz
uelisson-pc
uelitonbad-pc
uHUQIuwoEFU
UiQcX
ultramed-02
umyUJ
Uox1tzaMO
urls-windowsref
user
user-2a6e79da98
user-307b6f9098
user-30d30d6468
user-4b0c7e4c46
user-55f6b64612
user-69d0983294
user-7add3c5ffa
user-8994620187
user-a03bc07abf
user-b9d8d85c48
user-pc
User01
user201
username
userpc
userpc336346446
userpcccccccccc
UspG1y1C
usu-40afa2bad72
usuario
usuario-23eef58
usuario-acb1418
usuario-bb903fa
usuario-pc
usuario-vaio
usuarios-a17a00
usuário
usuário-pc
utilizador-vaio
valter
valéria-pc
vanciefancie
vanderle-1bb433
vani-6ed3c14093
vania-pc
vanusa-pc
varfileinfo
vendedor
via07
victor-pc
video
vip05-pc
virtual
virtual-7
virtual-win7
virtual-xp
virtualxp-56529
vista
vista-real2
vistaexperience
vm-pc
vmg-client
vmg_client
vm_winxp
vpsvst01
vs_version_info
vv
vwin7-maltest
vwin7pro-maltest
vwinxp-mailtest
vwinxp-maltest
vwinxppro-maltest
vzY4jmH0Jw02
w0fjuOVmCcP5A
wanderson-pc
WDAGUtilityAccount
wellington
wellingtonramos
wilbert-sc1310
wilbert-sc1724
wilbert-sc2006
wilbert-sc2201
wilbert-sc2403
wilbert-sc2511
william-pc
wilson-pc
win-e7ejc94fkp6
win-ehu9f33g4as
win-lrg949qld21
win-u9elnvppad0
win7-maltest
win7-pc
win7even-pc
win7pro-mailtest
win7pro-maltest
windows-pc
windows7-pc
windowshost02
windowshost04
windowshost06
windowshost07
windowsxp-sp2
winxp
winxp-maltest
winxp01
winxphostname
winxppro-maltest
winxpsp3
winxpsp3x32
winxp_re
wko105
wks-029
wolf
workstation
wrightpc
x-pc
xanny
xjoybook54
XMiMmcKziitD
xp-449dffbc2bd5
xp-c374c7c20a7d
xp-ps3
xp-silo5yeiykex
xp-soak1
xp-sp3-template
xp1001
xp1002
xp3-host01
xpamas07
xpamas08
xpamas09
xpc
xPLyvzr8sgC
xpsp2-4f417033d
xpsp2-9c443b10c
xs946t04f78kkmi
xUnUy
xx-pc
xxxxx-437226f51
xyoreu
ykj0egq7fze
ymONofg
your-5d270b6669
yuri-pc
z-235
zalo-pc
zgxtiqtg8837952
zOEsT