Static malware analysis soon hits its limits. Packed programs, multi-stage Office documents with macros and scripts that load their payload later often slip past signatures. A sandbox works differently. It runs the suspicious file in an isolated space and watches what it does. That is exactly what the SecTepe Malware Sandbox does.
What the Sandbox Delivers
The sandbox does not just say "suspicious or not". It shows which processes a file starts, which files it writes and which servers it contacts. For known malware families it also extracts the configuration, such as C2 servers and keys. Those are exactly the indicators threat intelligence needs.
How an Analysis Runs
The mail pipeline first checks each attachment with a virus scanner, YARA rules and hash reputation. If the result is "suspicious" or "unknown", it moves on:
- A static pre-check tests whether the file has active content, such as macros or executable code.
- The sandbox controller picks the right guest: Windows 10, Windows 11 or Linux.
- The file runs in an isolated VM. The pipeline waits up to 10 minutes for the report.
- The report lists processes, network traffic, file actions, registry changes and the indicators found.
- The mail verdict is updated. High-risk mails go to the four-eyes approval queue.
Why Malware Spots Sandboxes and What Helps
Modern malware checks whether it runs in a sandbox. It counts CPU cores, measures memory, checks MAC addresses or waits for user activity. The SecTepe Malware Sandbox counters this with:
- Current guest systems: Windows 10 22H2 and Windows 11 24H2, installed unattended from an answer file.
- Watching from outside: Our own engine, sectepe-vmi, records the behaviour through the hypervisor. No analysis agent runs inside the guest for the malware to find.
- Evasion as a finding: Signatures flag anti-VM, anti-debug and anti-sandbox tricks. Malware that tries to hide stands out for exactly that reason.
Windows and Linux Guests
Windows guests cover most cases: Office documents with macros, LNK files, ISO and IMG containers, batch and PowerShell scripts and MSI installers. Linux guests handle ELF files, shell scripts and Python loaders. After each analysis the VM returns to a clean state.
Better Results Through Threat Intelligence
Each analysis is enriched with data from the CTI stack. Indicators are checked against MISP, the hash against MalwareBazaar and the C2 domain against URLhaus. Instead of a bare "malicious" verdict, you get a readable report: which family, which C2 server, known since when and which MITRE ATT&CK technique.
Day-to-Day Operation
- Duration: The pipeline waits up to 10 minutes for a report. An analysis with sectepe-vmi takes 10–15 minutes. That is fine because the pipeline runs in the background. The mail shows up in the inbox once it is released.
- Capacity: The static pre-check sends only attachments with active content to the sandbox. A plain PDF invoice does not tie up an analysis VM.
- Quarantine: New items in the mail quarantine go to the sandbox automatically. This also works after the fact for mails that arrived before the sandbox was turned on.
Conclusion
A sandbox is no longer a premium extra. Serious mail security needs one. The SecTepe Malware Sandbox combines our own analysis from outside, threat intelligence and the mail workflow. You can use it with the Mail Security Gateway or on its own through its REST API.