Retrace

Retrace is an AI-powered malware-analysis platform built for security researchers, incident responders, and threat-intelligence teams. It is most compelling when analysts need interactive execution across several operating systems and answers anchored to recorded behavior. The main trade-off is that its free path is public, while privacy, queue priority, and deployment control require a paid tier.

Overview

Samples run in disposable virtual machines, so execution is separated from the analyst’s laptop. Retrace supports Windows, macOS, Linux, and Android virtual machines and records file writes, registry activity, network packets, and process spawns. That breadth gives investigators a concrete behavioral record rather than relying only on a static verdict.

Its AI copilot works against the sandbox trace and cites particular events, techniques, or captured files. This makes follow-up questions more auditable, although the citations still require an analyst to interpret context and significance. Each detonation is also matched against the user’s complete sandbox corpus, adding similarity and potential family evidence to an individual run.

Answers can be exported as Markdown, PDF, or STIX 2.1 bundles for MISP and other threat-intelligence platforms. Retrace therefore covers investigation and handoff in one workflow, with URL analysis, network-traffic analysis, and IOC extraction included among its capabilities.

Key features

• Interactive isolation: Disposable virtual machines let researchers interact with suspicious samples without exposing their laptop, across four supported operating-system families.
• Detailed telemetry: File, registry, network, and process records provide multiple evidence streams for incident response and malware analysis.
• Trace-grounded copilot: Answers cite observed events, techniques, or files, making the AI output easier to verify than an uncited summary.
• Corpus matching: Pattern matching against the full sandbox corpus can reveal similarity and family relationships that a single detonation would miss.
• Operational exports: Markdown and PDF suit human reports, while STIX 2.1 supports transfer into MISP and threat-intelligence tooling.
• Controlled deployment: Enterprise inference can run on-premises; Sovereign deployments are fully air-gapped and keep sample bytes, IOCs, and tool calls inside the customer’s infrastructure.

Pricing

Retrace uses a freemium model. Community costs nothing and includes Community feed access, a standard execution queue, the web interface, basic report export, and unlimited public analyses. It is a useful no-cost option for learning the workflow or investigating material that can safely be exposed, but public analyses reveal results, events, behavioral data, screenshots, and detection results to all service users. Standard queueing is also a poor match for urgent workloads.

Team has custom pricing and adds private submissions, priority queueing, REST API access, team management, and audit logging. It is the practical step up for collaborative analysts handling sensitive samples or needing programmatic submission. API keys must remain confidential, documented rate limits apply, and automated bulk submissions must follow fair-use guidelines.

Enterprise is custom pricing and adds a multi-tenant workspace, dedicated hardware with no shared services, optional UK, EU, or US data residency, SSO/SAML, and custom data retention. It suits organizations with identity, residency, and infrastructure requirements rather than occasional analysis.

Sovereign is custom pricing and is air-gap compatible, with unlimited throughput, full data sovereignty, custom hardware support, and a dedicated account manager. This is the tier for environments that cannot permit samples or analysis operations to leave their controlled infrastructure. Support is provided according to plan tier.

Platforms

Retrace is offered through web access and an API, with support for Android, Linux, macOS, Windows, and self-hosted deployment. The broad operating-system coverage is valuable for cross-platform investigations; the self-hosted and air-gapped options matter most to regulated or isolated environments.

Who it's for

Choose Retrace for legitimate security research, incident response, malware analysis, and threat intelligence where trace evidence and corpus-level similarity are central to the workflow. Community fits public, non-sensitive work. Team is better for private collaborative analysis, while Enterprise and Sovereign address residency, identity, dedicated infrastructure, and air-gap requirements. It is not the right default for confidential samples on the free tier.

Pros and cons

Pros

• Interactive, disposable VMs across Windows, macOS, Linux, and Android reduce the risk of running samples on an analyst’s laptop.
• AI responses cite trace events, techniques, and files, giving investigators evidence to examine.
• Corpus matching adds similarity and family context to each detonation.
• STIX 2.1, PDF, and Markdown exports support both intelligence platforms and conventional reporting.
• Higher tiers provide private submissions, APIs, audit controls, dedicated hardware, and sovereignty options.

Cons

• Community analyses are public, including behavioral data and screenshots, so it is unsuitable for sensitive submissions.
• The free tier uses the standard queue and only basic report export, limiting time-critical or polished workflows.
• Team, Enterprise, and Sovereign pricing is custom, making budget comparison difficult.
• API use carries rate limits and fair-use requirements, which constrain uncontrolled bulk automation.

Alternatives

Browse the Malware Analysis Sandboxes roundup for more options.

• ANY.RUN is a freemium alternative with a free trial and Android, iOS, Linux, macOS, web, and Windows coverage.
• Malwagon offers free scans with three scans per source address per day, no internet egress, and public reports.
• CAPE Sandbox is free, open-source, and self-hosted for teams that want to operate the sandbox themselves.
• Detonate provides a free self-hosted Community plan with two concurrent sandboxes, 200 API runs per month, unlimited manual UI use, and seven-day event retention.
• Hatching Triage is a volume-based service with packages starting at 500 analyses per day.
• Hybrid Analysis offers a free community service capped at 30 uploads per month and 100 MB per upload.
• Bitdefender Total Security is a paid endpoint-security product rather than a malware-analysis sandbox.
• Zscaler Private Access is a paid private-access service, not a direct sandbox substitute.

Verdict

Retrace is a strong choice for analysts who want interactive multi-OS execution, trace-cited AI answers, and similarity evidence in one service. Its decisive weakness is the public Community model; organizations handling confidential or urgent work should budget for Team, Enterprise, or Sovereign instead.