Kunai Sandbox – QEMU-based malware analysis platform

Kunai Sandbox is a malware-analysis platform that runs suspicious samples in QEMU virtual machines and uses Kunai to capture detailed behaviour from inside the sandbox.

Its focus is collecting useful telemetry for threat analysis and detection engineering rather than simply deciding whether a file is malicious. Analysts can execute a sample with its intended arguments, preserve traces and network data, and use that evidence to understand processes, system activity and communications. The project is particularly relevant to teams building detection rules or datasets from real malware execution.

This is free and open source software.

Key Features

• Supports sandbox environments for both x86_64 and AArch64 systems.
• Uses QEMU virtual machines to isolate samples from the analyst’s normal environment.
• Can take advantage of KVM acceleration where available while retaining full-system emulation as an option.
• Captures detailed Kunai traces showing behavioural and system-level activity generated by the sample.
• Produces network traffic dumps alongside execution telemetry for correlating host and network behaviour.
• Provides tooling to download known working QEMU images, initialise sandboxes and generate configuration files.
• Offers an interactive shell mode for checking and preparing a virtual machine before running malware.
• Lets analysts set analysis timeouts, pass arguments to samples and choose where analysis artefacts are written.
• Includes MISP export support for moving collected intelligence into threat-sharing workflows.
• Uses a configuration-driven workflow so different virtual machines, architectures and Kunai binaries can be selected for a particular analysis.
• The generated evidence is intended to help detection engineers study behavioural patterns and accelerate the creation of defensive rules.

Website: github.com/kunai-project/sandbox
Support:
Developer: qjerome
License: GNU General Public License v3.0

Kunai Sandbox is written in Python. Learn Python with our recommended free books and free tutorials.

Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category. This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form.