Kunai Sandbox is a malware-analysis platform that runs suspicious samples in QEMU virtual machines and uses Kunai to capture detailed behaviour from inside the sandbox.
Its focus is collecting useful telemetry for threat analysis and detection engineering rather than simply deciding whether a file is malicious. Analysts can execute a sample with its intended arguments, preserve traces and network data, and use that evidence to understand processes, system activity and communications. The project is particularly relevant to teams building detection rules or datasets from real malware execution.
This is free and open source software.
Key Features
- Supports sandbox environments for both x86_64 and AArch64 systems.
- Uses QEMU virtual machines to isolate samples from the analyst’s normal environment.
- Can take advantage of KVM acceleration where available while retaining full-system emulation as an option.
- Captures detailed Kunai traces showing behavioural and system-level activity generated by the sample.
- Produces network traffic dumps alongside execution telemetry for correlating host and network behaviour.
- Provides tooling to download known working QEMU images, initialise sandboxes and generate configuration files.
- Offers an interactive shell mode for checking and preparing a virtual machine before running malware.
- Lets analysts set analysis timeouts, pass arguments to samples and choose where analysis artefacts are written.
- Includes MISP export support for moving collected intelligence into threat-sharing workflows.
- Uses a configuration-driven workflow so different virtual machines, architectures and Kunai binaries can be selected for a particular analysis.
- The generated evidence is intended to help detection engineers study behavioural patterns and accelerate the creation of defensive rules.
Website: github.com/kunai-project/sandbox
Support:
Developer: qjerome
License: GNU General Public License v3.0
Kunai Sandbox is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Malware Sandboxes | |
|---|---|
| DRAKVUF Sandbox | Agentless malware analysis using hardware virtualization |
| Cuckoo3 | Automated malware analysis sandbox |
| Nyxelf | Static and dynamic analysis of ELF malware |
| Kunai Sandbox | QEMU-based platform for dynamic malware analysis |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.