Modern malware first checks if it is being watched. The moment it spots an analysis agent, an injected hook, or a sandbox artifact, it plays harmless. The SecTepe Sandbox turns the tables. It uses the engine sectepe-vmi. A sample is detonated in a real Windows or Linux guest and watched fully from outside the guest. There is no in-guest agent, no injected DLL, and no kernel driver. So there is nothing the malware could find and turn off.
Watching From Outside: Virtual Machine Introspection
The base is Virtual Machine Introspection (VMI) built on IntroVirt. IntroVirt is a KVM-native engine on par with DRAKVUF. It looks straight at the guest's memory and what the guest runs, over a patched KVMi interface. The analysis host is a KVM/KVMi VM. One runner host serves Windows 10, Windows 11, and Linux side by side. IntroVirt was shown to work with Windows 11 (22H2, build 22621).
Launch Without a Trace on Windows
This is the key trick against anti-analysis: on Windows there is no launcher artifact on disk. No RunOnce key, no AutoLogon, no startup script. The tool takes over a live guest thread instead. It forces that thread through a synthetic NtCreateUserProcess syscall, and that starts the sample. From the malware's point of view, there is no trace of analysis to see.
The iv* Toolchain
A set of focused tools does the watching. They all write their output in the same sectepe-vmi JSONL format:
ivexec– start the run,ivguestinfoandivprocinfo– data on the guest and its processes,ivsyscallmon– watch syscalls,ivprocmemdumpandivwritefile– memory dumps and file access.
By design, each domain allows only one introspection session. Two attaches at once lead to a DomainBusyException. So the tools run strictly one after the other. A warm-up loop for OS detection polls ivguestinfo. That way it reliably catches race issues while Windows 11 boots.
Android, Live Sessions, and a Clean Reset
The agentless analysis also covers Android-x86. APKs/DEX go through the same out-of-VM path, with no in-guest agent. For hands-on analysis there is a WebRTC interactive session:
- the QEMU display runs over GStreamer,
- input runs over DataChannel,
- it works even in a mobile browser.
Interactive VMs start and stop on their own and run only as long as the operator's session. Reset uses libvirt snapshots or rebuilds a fresh overlay. That also clears out stubborn INT3/MSR hooks.
A note on names: the tech base is IntroVirt/KVMi. In product text the engine is called sectepe-vmi and the product is the SecTepe Sandbox. Two later stages depend on hardware: bare-metal introspection and ARM64 VMI. They are planned on the road map, not shipped.
Conclusion
With sectepe-vmi, the SecTepe Sandbox becomes a tool the malware does not see coming. It watches fully from outside, starts samples without a trace, has a clean toolchain, and resets on its own. Being unseen is what sets it apart from classic in-guest sandboxes. It is also why evasive samples show their true behavior here. To see how the results are then sorted, read the post on IoC confidence tiers.