Cuckoo3 – automated malware analysis sandbox

Cuckoo3 is an automated malware analysis system for examining suspicious files and links inside controlled virtualised environments.

The software runs on a Linux host and executes submitted material in isolated Windows sandboxes, recording what happens during the analysis and assembling observations into reports for investigation. It is aimed at malware researchers, incident responders and security teams that need to study behaviour rather than rely only on signatures or static inspection. Its modular design separates analysis, processing, storage and the web-facing workflow.

This is free and open source software.

Key Features

• Accepts suspicious files and URLs for automated sandbox execution.
• Provides a web interface for submitting analyses and reviewing reports.
• Uses virtual machines prepared with VMCloak for reproducible Windows analysis environments.
• Includes a Quickstart workflow that creates a dedicated non-privileged Cuckoo user and configures supporting services.
• Offers API endpoints for integrating submissions and results with external security workflows.
• Processes captured network traffic with optional Suricata integration and exposes resulting alerts in reports.
• Report components can surface network information, configuration extraction, screenshots, MISP data and IntelMQ information.
• Uses YARA-based processing alongside other detection and matching components in the analysis pipeline.
• Separates core orchestration, machinery, processing and web components so deployments can be adapted to different analysis requirements.
• Provides configuration-driven machinery and processing settings for tailoring an analysis laboratory.
• Generates structured behavioural results that help analysts understand what a submitted file or website attempted to do while isolated from production systems.
• Upstream describes the software as unsuitable for production use at present, so evaluation and testing are important before operational deployment.

Website: github.com/cert-ee/cuckoo3
Support:
Developer: Estonian Information System Authority (CERT-EE)
License: European Union Public Licence v1.2

Cuckoo3 is written in Python. Learn Python with our recommended free books and free tutorials.

Related Software

Read our verdict in the software roundup.

LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software. We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README.