Modern malware first checks whether it is being watched – and plays harmless the moment it detects an analysis agent, an injected hook, or a sandbox artifact. The SecTepe Sandbox turns the tables: with the engine sectepe-vmi, a sample is detonated in a real Windows or Linux guest and observed entirely from outside the guest. No in-guest agent, no injected DLL, no kernel driver – nothing the malware could find and disable.
Watching From Outside: Virtual Machine Introspection
The basis is Virtual Machine Introspection (VMI) built on IntroVirt – a KVM-native, DRAKVUF-equivalent engine that looks directly at the guest's memory and execution over a patched KVMi interface. The analysis host is a KVM/KVMi VM; a single runner host serves Windows 10, Windows 11, and Linux in parallel. IntroVirt was demonstrably verified against Windows 11 (22H2, build 22621).
Artifact-Free Launch on Windows
The decisive trick against anti-analysis: on Windows there is no launcher artifact on disk. Instead of a RunOnce key, an AutoLogon, or a startup script, the sample is launched by hijacking a live guest thread and forcing it through a synthetic NtCreateUserProcess syscall. From the malware's point of view, simply no telltale analysis artifact appears.
The iv* Toolchain
Observation happens via a set of specialized tools that all emit their output in the uniform sectepe-vmi JSONL format:
ivexec– trigger execution,ivguestinfoandivprocinfo– guest and process information,ivsyscallmon– syscall monitoring,ivprocmemdumpandivwritefile– memory dumps and file access.
Per domain only one introspection session is deliberately allowed (concurrent attaches lead to a DomainBusyException), so the tools work strictly sequentially. An OS-detection warm-up loop polls ivguestinfo to reliably catch Windows 11 boot races.
Android, Interactive Sessions, and Clean Reset
The agentless analysis also covers Android-x86: APKs/DEX are analyzed over the same out-of-VM path instead of an in-guest agent. For manual analysis there is a WebRTC interactive session (QEMU display over GStreamer, input over DataChannel, even in the mobile browser); interactive VMs start and stop automatically only for the duration of the operator session. Reset happens via libvirt snapshots or a fresh overlay rebuild – which also removes stubborn INT3/MSR hooks.
Naming note: the technical base uses IntroVirt/KVMi; in product communication the engine is called sectepe-vmi and the product SecTepe Sandbox. The hardware-dependent expansion stages – bare-metal introspection and ARM64 VMI – are specified as roadmap, not shipped.
Conclusion
sectepe-vmi makes the SecTepe Sandbox an analysis tool the malware doesn't see coming: observation entirely from outside, artifact-free launch, a clean toolchain, and automatic reset. This very invisibility is the difference from classic in-guest sandboxes – and the reason evasive samples reveal their true behavior here. How the results are then triaged is shown in the post on IoC confidence tiers.