Kunai Sandbox is a malware-analysis platform that runs suspicious samples in QEMU virtual machines and uses Kunai to capture detailed behaviour from inside the sandbox.
Its focus is collecting useful telemetry for threat analysis and detection engineering rather than simply deciding whether a file is malicious. Analysts can execute a sample with its intended arguments, preserve traces and network data, and use that evidence to understand processes, system activity and communications. The project is particularly relevant to teams building detection rules or datasets from real malware execution.
This is free and open source software.
Key Features
- Supports sandbox environments for both x86_64 and AArch64 systems.
- Uses QEMU virtual machines to isolate samples from the analyst’s normal environment.
- Can take advantage of KVM acceleration where available while retaining full-system emulation as an option.
- Captures detailed Kunai traces showing behavioural and system-level activity generated by the sample.
- Produces network traffic dumps alongside execution telemetry for correlating host and network behaviour.
- Provides tooling to download known working QEMU images, initialise sandboxes and generate configuration files.
- Offers an interactive shell mode for checking and preparing a virtual machine before running malware.
- Lets analysts set analysis timeouts, pass arguments to samples and choose where analysis artefacts are written.
- Includes MISP export support for moving collected intelligence into threat-sharing workflows.
- Uses a configuration-driven workflow so different virtual machines, architectures and Kunai binaries can be selected for a particular analysis.
- The generated evidence is intended to help detection engineers study behavioural patterns and accelerate the creation of defensive rules.
Website: github.com/kunai-project/sandbox
Support:
Developer: qjerome
License: GNU General Public License v3.0
Kunai Sandbox is written in Python. Learn Python with our recommended free books and free tutorials.
Related Software
| Malware Sandboxes | |
|---|---|
| DRAKVUF Sandbox | Agentless malware analysis using hardware virtualization |
| Cuckoo3 | Automated malware analysis sandbox |
| Nyxelf | Static and dynamic analysis of ELF malware |
| Kunai Sandbox | QEMU-based platform for dynamic malware analysis |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.