DRAKVUF Sandbox – agentless malware analysis platform

DRAKVUF Sandbox is an automated black-box malware analysis platform built around the DRAKVUF virtual machine introspection engine.

It examines suspicious files in isolated Windows guest systems while keeping the monitoring machinery outside the guest. This agentless approach reduces the instrumentation visible to malware and lets analysts observe behaviour without installing a conventional analysis agent in the target environment. A web interface handles sample submission and presents completed analysis, making the platform useful for malware researchers, incident-response teams and security laboratories that need repeatable behavioural analysis.

This is free and open source software.

Key Features

• Uses DRAKVUF for virtual machine introspection and agentless monitoring of guest activity.
• Provides a web interface for uploading suspicious files and exploring completed analysis results.
• Exposes an API as another primary interface for interacting with the sandbox.
• Includes an installer that guides administrators through the substantial sandbox setup process and supplies recommended defaults.
• Supports Windows guest environments running on a Linux host.
• Built around Xen, with KVM also used by the project for nested-virtualisation development and testing.
• Requires Intel virtualisation support with Extended Page Tables for the intended monitoring architecture.
• Allows experienced administrators to replace or tune infrastructure components rather than treating the deployment as a fixed appliance.
• Stores analyses locally by default and offers optional S3 integration for alternative storage arrangements.
• Separates sandbox execution from the analyst-facing reporting workflow, helping users inspect potentially malicious behaviour from the host side.
• Targets serious malware-analysis deployments rather than lightweight local scanning; upstream warns that maintaining the sandbox can require significant debugging and administration skills.

Website: github.com/CERT-Polska/drakvuf-sandbox
Support:
Developer: CERT Polska – NASK PIB
License: GNU General Public License v2.0

DRAKVUF Sandbox is written in Python and JavaScript. Learn Python with our recommended free books and free tutorials. Learn JavaScript with our recommended free books and free tutorials.

Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category. This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form.