Cuckoo3 – automated malware analysis sandbox

Cuckoo3 is an automated malware analysis system for examining suspicious files and links inside controlled virtualised environments.

The software runs on a Linux host and executes submitted material in isolated Windows sandboxes, recording what happens during the analysis and assembling observations into reports for investigation. It is aimed at malware researchers, incident responders and security teams that need to study behaviour rather than rely only on signatures or static inspection. Its modular design separates analysis, processing, storage and the web-facing workflow.

This is free and open source software.

Key Features

• Accepts suspicious files and URLs for automated sandbox execution.
• Provides a web interface for submitting analyses and reviewing reports.
• Uses virtual machines prepared with VMCloak for reproducible Windows analysis environments.
• Includes a Quickstart workflow that creates a dedicated non-privileged Cuckoo user and configures supporting services.
• Offers API endpoints for integrating submissions and results with external security workflows.
• Processes captured network traffic with optional Suricata integration and exposes resulting alerts in reports.
• Report components can surface network information, configuration extraction, screenshots, MISP data and IntelMQ information.
• Uses YARA-based processing alongside other detection and matching components in the analysis pipeline.
• Separates core orchestration, machinery, processing and web components so deployments can be adapted to different analysis requirements.
• Provides configuration-driven machinery and processing settings for tailoring an analysis laboratory.
• Generates structured behavioural results that help analysts understand what a submitted file or website attempted to do while isolated from production systems.
• Upstream describes the software as unsuitable for production use at present, so evaluation and testing are important before operational deployment.

Website: github.com/cert-ee/cuckoo3
Support:
Developer: Estonian Information System Authority (CERT-EE)
License: European Union Public Licence v1.2

Cuckoo3 is written in Python. Learn Python with our recommended free books and free tutorials.

Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category. This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form.