Keywords
Malware, Sandboxing, Telemetry, Containers

Technologies
Go, Podman, gVisor, SQL, Docker

Malspect is a container-based malware analysis sandbox that executes untrusted binaries in an isolated environment, and produces behavioural risk assessments from syscall-level telemetry. The project investigates whether containerization, combined with a user-space kernel, can provide a viable alternative to traditional VM sandboxes for lightweight dynamic analysis.

The system uses Podman with gVisor (runsc) as the container runtime. gVisor intercepts every syscall in the user space, providing both strengthened isolation and complete observability without exposing the host kernel to malware. Captured syscall traces are parsed and evaluated by a rule-based heuristics engine that maps observed behaviours to the MITRE ATT&CK framework, assigns severity tiers based on kill-chain position, and computes a composite risk score classifying samples as benign, suspicious, or malicious.