SecTepe Malware Sandbox– run suspicious files safely
The sandbox runs suspicious files in isolated Windows and Linux VMs and shows what they really do. You submit files via API from your own systems. With the Mail Security Gateway or the EDR agent, it happens automatically.
Request a demoAt a glance
- Standalone use through a REST API
- Own VMI engine, no agent in the guest
- Windows 10 and Windows 11 guest VMs
- AI reverse engineer explains every sample
- Signatures, detection rules, screenshots
- Self-hosted, no cloud sandbox
Malware analysis: static checks are not enough
A virus scanner compares files with known patterns. Packed programs, macro documents or scripts that download their payload later often slip through. A malware sandbox takes a different approach. It runs the file and watches how it behaves.
The SecTepe Malware Sandbox is our own development. The controller, the pre-check and the VMI engine come from us. The sandbox is a product of its own. You can run it by itself and call it from any system that can send files over HTTP. Our articlesectepe-vmi: agentless malware analysisexplains how the analysis from outside works.
Features at a glance
What the sandbox does with a sample and what you see in the report.
Windows 10 and 11 guest VMs
Samples run in guest VMs with Windows 10, Windows 11 or Linux. Linux guests handle ELF binaries, shell scripts and Python loaders. After each run the VM returns to a clean state.
Analysis from outside (VMI)
Every analysis runs through our own engine, sectepe-vmi. It watches the VM from the outside through the hypervisor. No analysis agent runs in the guest for the malware to find.
Signatures and detection rules
The sandbox uses behaviour signatures and a large set of detection rules for malware families. The rules are updated all the time.
Config and memory
The sandbox extracts the configuration of known families, such as C2 servers and keys. It analyzes a memory dump and spots whether a program is packed or obfuscated.
Network and enrichment
The sandbox checks indicators it finds against our threat intelligence. If you want, a TLS proxy captures the encrypted traffic of the sample.
Screenshots and report
Screenshots are taken while the sample runs. The report lists signatures, processes, file and network activity. An AI reverse engineer explains the results in a short report.
Features in detail
Three topics explained in depth: analysis from the outside, the AI report and submission via API.
Agentless VMI analysis
sectepe-vmi watches every sample from the outside through the hypervisor, in Windows and Linux guests.
Learn more →AI reverse engineer
It turns every analysis into a readable report with a verdict and the reasons behind it.
Learn more →API and submission
Submit files via REST API, get the verdict by hash and connect the gateway or EDR.
Learn more →How to submit files
Every path goes through the sandbox controller. It accepts samples and hands them to the right engine. These are the ways to submit:
- REST API: your system registers the file with its name and SHA-256, then uploads it. You fetch the report and verdict by job ID or hash. Access is protected by an API key.
- Your own mail, EDR or SOC systems: you connect them through this API. We are happy to plan the integration with you.
- Mail Security Gateway: attachments with active content go to the sandbox automatically.
- SecTepe EDR agent (opt-in): the agent uploads unknown executables on Windows and Linux after it has made its decision, once per hash.
The result flows back to the source. In the EDR, the verdict then applies to that hash. In "enforce" mode, the agent blocks the next launch of a file rated malicious.
Even stronger together
The sandbox works on its own. Combined with other SecTepe products, you can act on its results faster.
The Mail Security Gatewayonly sends attachments with active content to the sandbox. Admins see the screenshots in the quarantine view. If a verdict arrives after delivery, the gateway pulls the message back from every mailbox.
SecTepe EDR hands over unknown programs from endpoints. Hits show up as alerts inour SIEM. Your team or our Security Operations Centerreviews them. Detected samples can be stored in the malware archive ofSecTepe.Core threat intelligence.
AI reverse engineer
- Turns signatures, rule hits, MITRE techniques and IOCs into a short report.
- Gives a verdict from "benign" to "critical" with a reason.
- Message text and samples never leave the system. You can run the model on your own GPU server.
Data sovereignty: your samples stay with you
Many sandbox services run in the cloud. Uploading a file there means giving it away. For internal documents, that is often not an option.
The SecTepe Malware Sandbox runs on a dedicated sandbox host. We run it for you in Germany, or you set it up on your own premises. Samples, reports and screenshots stay in your environment. Only the AI reverse engineer talks to a language model, and only with features such as hashes and signatures. It is part of every analysis.
FAQ: Malware Sandbox
- What is a malware sandbox?
- A malware sandbox runs a suspicious file inside an isolated virtual machine. It watches what the file does: which processes it starts, which files it writes and which hosts it contacts. That way it catches malware a plain virus scanner misses.
- Can I use the sandbox without the Mail Security Gateway?
- Yes. The sandbox has its own REST API. You use it to submit files from any system, such as your mail server, your EDR or your SOC tools. The Mail Security Gateway and the SecTepe EDR agent are ready-made integrations, not requirements.
- What did SecTepe build itself?
- The core: the sandbox controller, the static pre-check, the VMI engine sectepe-vmi, the links to the gateway, EDR and CTI, and the AI reverse engineer. Every analysis runs via VMI, in Windows and Linux guests.
- Which files can I submit?
- The sandbox focuses on Windows files: programs, DLLs, scripts, Office documents and PDFs. ELF files and shell scripts go to a Linux guest. Links are not checked by the sandbox itself but by the URL detonator in the Mail Security Gateway.
- Can malware tell it is running in a sandbox?
- Some malware tries. That is why our engine sectepe-vmi watches every sample from outside, through the hypervisor. The monitoring then runs outside the guest. No product can fully guarantee that a sandbox goes undetected.
- Where do my samples run?
- The sandbox runs on a dedicated sandbox host, not at a cloud provider. You choose: we run the host for you in Germany, or you set it up in your own data centre. Reports and screenshots stay with you. The AI reverse engineer only sends features such as hashes and signatures to a language model. You can also run it against your own GPU server.
Your own sandbox instead of a cloud upload
We show you an analysis and discuss how to connect the sandbox to your systems.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.