What does agentless malware analysis mean?

No analysis software runs inside the guest system. The sectepe-vmi engine watches the virtual machine from the outside, through the hypervisor. The malware finds nothing that gives the test away or that it could switch off.

Can malware still detect the sandbox?

Watching from the outside takes away the usual clues. But no product can fully guarantee that malware never detects a sandbox. We prefer to tell you that up front.

Where does the analysis run?

On a dedicated sandbox host, not with a cloud provider. We run it for you in Germany, or you place it in your own data center. Samples and reports stay with you.

Back to the Malware Sandbox

Dynamic malware analysis

Malware analysis from the outside: the sample never notices

The SecTepe Malware Sandbox runs suspicious files and watches them from the outside. It uses our own engine, sectepe-vmi. No analysis software runs inside the guest system, so there is nothing for the malware to find.

Request a demo

Why malware detects sandboxes

Many threats check their surroundings first. They look for analysis tools and for traces of a test setup. If they find any, they play dead. The report then looks clean, even though the file is dangerous.

Think of a shoplifter who spots the store detective. As long as the detective stands nearby, nothing happens. Good dynamic malware analysis has to stay out of sight.

How watching through the hypervisor works

The hypervisor is the software that runs virtual machines. sectepe-vmi uses it to look straight into the guest's memory. This method is called virtual machine introspection, or VMI. Every analysis runs this way.

No agent, no driver

The guest has no agent, no injected module and no driver. So the malware finds nothing it could switch off.

A clean start with no traces

On Windows, no start script sits on the disk. sectepe-vmi borrows a task that is already running in the guest and starts the file from there. There is no helper program for the malware to see.

What you see in the report

The sandbox records processes, file activity and network activity. It also takes screenshots while the file runs. The AI reverse engineersums it all up in a short report with a verdict.

Windows 10, Windows 11 and Linux guests

One analysis host runs Windows 10, Windows 11 and Linux side by side. The sandbox picks the guest by file type. Programs, DLLs, Office documents, PDFs and Windows scripts run on Windows. ELF files, which are Linux programs, and shell scripts run on Linux.

We set up the Windows guests automatically. Then the sandbox takes a snapshot. That is a clean state it can always go back to.

Back to square one after every sample

After each analysis, the sandbox resets the guest to the snapshot or rebuilds it from scratch. Nothing from the last sample stays behind. Every file starts in the same clean setup, so results never mix.

How long does an analysis take?

Plan for 10 to 15 minutes per sample. That includes a full start of the guest. Because this takes time, mail attachments only run if they have active content. A plain PDF invoice with no scripts does not need to run. Learn more on the pageAPI and submission.

Our postsectepe-vmi: agentless malware analysisexplains the technology in detail. For how a sandbox checks samples on its own, readAutomated malware analysis with a sandbox. The basics are in our glossary undermalware analysis.

FAQ: agentless analysis

What does agentless malware analysis mean?: No analysis software runs inside the guest system. The sectepe-vmi engine watches the virtual machine from the outside, through the hypervisor. The malware finds nothing that gives the test away or that it could switch off.
Can malware still detect the sandbox?: Watching from the outside takes away the usual clues. But no product can fully guarantee that malware never detects a sandbox. We prefer to tell you that up front.
Which files run in the Linux guest?: ELF files and shell scripts go to the Linux guest. Programs, DLLs, Office documents, PDFs and Windows scripts run on Windows. The sandbox picks the guest based on the file type.
Where does the analysis run?: On a dedicated sandbox host, not with a cloud provider. We run it for you in Germany, or you place it in your own data center. Samples and reports stay with you.

See an analysis live

We show you how the sandbox watches a sample from the outside and what ends up in the report.

Request a demo

How we work with you

We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.

1. Free initial conversation

We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.

2. Current state review

We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.

3. Delivery with a dedicated lead

An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.

4. Running and reviewing

After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.