Cuckoo3 is an automated malware analysis system for examining suspicious files and links inside controlled virtualised environments.
The software runs on a Linux host and executes submitted material in isolated Windows sandboxes, recording what happens during the analysis and assembling observations into reports for investigation. It is aimed at malware researchers, incident responders and security teams that need to study behaviour rather than rely only on signatures or static inspection. Its modular design separates analysis, processing, storage and the web-facing workflow.
This is free and open source software.
Key Features
- Accepts suspicious files and URLs for automated sandbox execution.
- Provides a web interface for submitting analyses and reviewing reports.
- Uses virtual machines prepared with VMCloak for reproducible Windows analysis environments.
- Includes a Quickstart workflow that creates a dedicated non-privileged Cuckoo user and configures supporting services.
- Offers API endpoints for integrating submissions and results with external security workflows.
- Processes captured network traffic with optional Suricata integration and exposes resulting alerts in reports.
- Report components can surface network information, configuration extraction, screenshots, MISP data and IntelMQ information.
- Uses YARA-based processing alongside other detection and matching components in the analysis pipeline.
- Separates core orchestration, machinery, processing and web components so deployments can be adapted to different analysis requirements.
- Provides configuration-driven machinery and processing settings for tailoring an analysis laboratory.
- Generates structured behavioural results that help analysts understand what a submitted file or website attempted to do while isolated from production systems.
- Upstream describes the software as unsuitable for production use at present, so evaluation and testing are important before operational deployment.
Website: github.com/cert-ee/cuckoo3
Support:
Developer: Estonian Information System Authority (CERT-EE)
License: European Union Public Licence v1.2
Cuckoo3 is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Malware Sandboxes | |
|---|---|
| DRAKVUF Sandbox | Agentless malware analysis using hardware virtualization |
| Cuckoo3 | Automated malware analysis sandbox |
| Nyxelf | Static and dynamic analysis of ELF malware |
| Kunai Sandbox | QEMU-based platform for dynamic malware analysis |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.