DRAKVUF Sandbox
DRAKVUF Sandbox is a free, open-source system for automated black-box malware analysis powered by the DRAKVUF engine.
What DRAKVUF Sandbox is
DRAKVUF Sandbox is a free, open-source system for automated black-box malware analysis powered by the DRAKVUF engine. It analyzes suspicious files without requiring an agent inside the guest operating system. Users upload samples through a web interface and inspect reports covering process trees, network and domain activity, changed or deleted files, and high-level TTP indicators. Default monitoring includes WinAPI calls, file operations, memory regions, processes, network connections, DNS queries, and TLS master keys. Available artifacts can include PCAP traffic, intercepted TLS keys, and memory dumps. Uploads can disable guest internet access to reduce external contact. The workflow includes a web application, queue, dashboard, and API, with optional S3 storage and an experimental Karton plugin in release v0.21.0. On-premises deployment requires documented Debian 12 or Ubuntu 22.04 hosts, supported Intel virtualization features, and Xen 4.17 or later. Windows 10 x64 and Windows 7 x64 are supported guests. The project is licensed under GPL version 2.
Good
- Agentless guest analysis
- Web uploads and reports
- Monitors network and system behavior
- Downloadable PCAP and memory artifacts
- API and optional S3 integration
Watch out
- Cloud hosting is unsupported
- Hyper-V does not work
- KVM is experimental
- Only 100 recent analyses appear in the view
Who it suits
DRAKVUF Sandbox suits security teams and experienced operators analyzing suspicious files on premises. It is intended for users prepared to troubleshoot configuration-dependent sandbox issues.
Verdict
DRAKVUF Sandbox provides detailed, agentless malware analysis with reports, artifacts, network controls, and an API. Its setup is infrastructure-heavy and requires supported virtualization hardware and substantial maintenance expertise.
The facts
Each one read from DRAKVUF Sandbox's own pages, with the date it was checked.
What it does
- Agentless analysis
- The analysis process does not require an agent on the guest operating system.checked 9 Oct 2026
- Analysis interface
- Its web interface lets users upload suspicious files and inspect analysis results to assess whether a file is malicious.checked 9 Oct 2026
- Analysis reports
- Reports include process trees, network and domain activity, modified and deleted files, and high-level TTP indicators.checked 9 Oct 2026
- Analysis workflow
- The documented stack includes a Flask-based web application, an rq-based worker, and Redis for communication between them.checked 9 Oct 2026
- API
- The documentation describes an API as part of the core workflow, alongside the analysis queue and dashboard.checked 9 Oct 2026
- Artifacts
- Users can download recorded PCAP traffic, intercepted TLS keys, and memory dumps when available.checked 9 Oct 2026
- Behavior monitoring
- Default plugins monitor WinAPI calls, file operations, memory regions, processes, network connections, DNS queries, and TLS master keys.checked 9 Oct 2026
- Cloud limitation
- The documentation says cloud hosting is unsupported because required CPU features are not exposed, and Hyper-V does not work.checked 9 Oct 2026
- Guest systems
- The documentation lists Windows 10 x64 and Windows 7 x64 as supported guest systems.checked 9 Oct 2026
- Host requirements
- The documented host requirements include Debian 12 or Ubuntu 22.04, an Intel processor with VT-x and EPT, at least two CPU cores and 8 GB RAM, and GRUB.checked 9 Oct 2026
- Hypervisor
- Xen 4.17 or later is required, with version 4.19 recommended; KVM is described as experimental.checked 9 Oct 2026
- Installation
- The project provides an installation toolkit to guide users through setup, and experienced users can customize settings and infrastructure.checked 9 Oct 2026
- Integrations
- Optional integrations include S3 for analysis storage and an experimental Karton integration plugin in release v0.21.0.checked 9 Oct 2026
- Intended users
- The project warns that maintaining a sandbox is difficult and advises users to be prepared to debug issues that may depend on their configuration.checked 9 Oct 2026
- License
- The license identifies DRAKVUF Sandbox as free software under GPL version 2 with stated clarifications and exceptions.checked 9 Oct 2026
- Network isolation
- An upload option can disable internet access for the guest VM to help prevent samples from contacting external servers.checked 9 Oct 2026
- Optional storage
- The documentation lists S3 integration as an optional feature.checked 9 Oct 2026
- Purpose
- DRAKVUF Sandbox is an automated black-box malware analysis system powered by the DRAKVUF engine.checked 9 Oct 2026
- Retention limit
- The Analyses view remembers only the 100 most recent analyses, though all analyses remain reachable by ID.checked 9 Oct 2026
- Security model
- The project describes itself as black-box analysis that does not require an agent inside the guest operating system.checked 9 Oct 2026
- Setup and support
- The project provides an installation toolkit, recommends basic Xen knowledge, and lists [email protected] and a Discord channel for questions.checked 9 Oct 2026
- Support
- The maintainers list [email protected] as the fastest general contact and provide a Discord community link.checked 9 Oct 2026
The company
- Headquarters
- Warsaw, Polandchecked 28 Sep 2026
- Maker
- CERT Polska operates within NASK, Poland’s National Research Institute; its website lists an address in Warsaw, Poland, and says the team has been active since 1996.checked 9 Oct 2026
Alternatives to DRAKVUF Sandbox
- 1
Malwagon
Free planWebAPILinuxmacOS7.7From $79 a month - 2
ANY.RUN
Free planAndroidiOSWebAPI7.5Free plan - 3
CAPE Sandbox
Free planOpen sourceWebAPILinuxSelf-hosted7.4Free plan - 4
Detonate
Free planWebAPILinuxSelf-hosted7.3From $4,990 a year - 5
CrowdStrike Falcon Pro
AndroidiOSWebAPI7.1From $99.99 a year - 6
Retrace
Free planAndroidWebAPILinux6.9Free plan