CAPE Sandbox
7.4#3 in malware analysis sandboxesFree planFree planWebAPILinuxSelf-hosted
VisitCAPE Sandbox vs DRAKVUF Sandbox
DRAKVUF Sandbox
5.8#15 in malware analysis sandboxesWebAPILinuxSelf-hosted
VisitWhat both publish
| Fact | CAPE Sandbox | DRAKVUF Sandbox |
|---|---|---|
| Behavior monitoring | Windows analysis uses API-hook instrumentation and behavioral signatures. | Default plugins monitor WinAPI calls, file operations, memory regions, processes, network connections, DNS queries, and TLS master keys. |
| Integrations | The documentation covers integrations with Box-js, LibreNMS, and Suricata, and describes CAPE's modular design for integrating external services. | Optional integrations include S3 for analysis storage and an experimental Karton integration plugin in release v0.21.0. |
| Purpose | CAPE is an open-source malware sandbox that runs suspicious files in an isolated environment while monitoring behavior and collecting forensic artifacts. | DRAKVUF Sandbox is an automated black-box malware analysis system powered by the DRAKVUF engine. |
CAPE Sandbox plans
- CAPE SandboxFree
- Public demonstration instanceFree
DRAKVUF Sandbox plans
No prices published.
Pick CAPE Sandbox if…
CAPE suits security teams and researchers who need to inspect suspicious files and automate analysis. It requires users to manage a host-and-guest deployment and take responsibility for using the tool.
Pick DRAKVUF Sandbox if…
DRAKVUF Sandbox suits security teams and experienced operators analyzing suspicious files on premises. It is intended for users prepared to troubleshoot configuration-dependent sandbox issues.