CAPE Sandbox

What CAPE Sandbox is

CAPE Sandbox is a free, open-source malware analysis tool that runs malicious files in an isolated environment and records their behavior and forensic artifacts. It captures API-hook activity, file changes, network traffic as PCAP, desktop screenshots, and full memory dumps. It can dynamically unpack malware and extract configurations through static and dynamic analysis. Classification can draw on YARA scans of unpacked payloads, Suricata scans of network captures, and behavioral signatures from API-hook output. A programmable debugger supports custom unpacking and configuration extractors, anti-sandbox countermeasures, and instruction traces. Configuration parsing supports CAPE’s framework and integrations including RATDecoders, DC3-MWCP, MalDuck, and MaCo. Documentation covers REST API use, distributed setup, and endpoints for tasks, reports, files, PCAPs, and machines. The project recommends Ubuntu 24.04 LTS for installation, Windows 10 or Windows 11 23H2 as the target, and KVM as the hypervisor. Active unpacking is disabled by default because it may affect detonation quality.