Color: Blue team.
What Is This Category?
Mix (10 tools)
- License: 5 open source · 5 proprietary
- Hosting: 5 self-hosted · 3 SaaS · 2 both
A malware analysis sandbox runs an untrusted file (executable, document, archive, URL) in an isolated, fully-instrumented VM and records everything the file does: file system, registry, network, API calls, child processes, child URLs. The output is a structured report that an analyst (or SOAR playbook) can consume to decide block / allow / hunt.
This category also includes analyst-workstation distros (FLARE-VM, REMnux) that are sandbox- adjacent. They aren’t themselves sandboxes but the malware-analysis workflow uses them constantly: the captured artefacts get analysed on FLARE-VM or REMnux after sandbox detonation.
Distinct from neighbouring categories
- EDR / XDR – EDR detects behaviour on real endpoints; sandbox detonates in isolation to characterise the artefact before it lands
- Digital Forensics & IR (DFIR) – DFIR investigates what an attacker did; sandbox tells you what the attacker’s tool does
- Reverse Engineering / Binary Analysis – RE is manual deep-dive on a specific sample; sandbox is automated triage across many samples
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Category Scope
Malware sandbox is split between detonation platforms (CAPE, Cuckoo3, DRAKVUF-sandbox, Joe Sandbox, VMRay, ANY.RUN, Triage, Hybrid Analysis) and analyst-workstation distros (FLARE-VM, REMnux) that are sandbox-adjacent. Both are included in this category because the analyst workflow spans them: a sample gets detonated in a sandbox, the captured artefacts get analysed on FLARE-VM / REMnux, and the IOCs go into the TIP.
The Hatching Triage entry cross-references Digital Forensics & IR (DFIR). It appears in both categories because the tool fits both – the dfir entry emphasises IR / indicator- extraction workflow; this entry emphasises sandbox classification.
Capability Matrix
| Tool | Detonation | Agentless | Interactive | Multi-OS | On-Prem |
|---|---|---|---|---|---|
| CAPE | yes | – | – | yes | yes |
| Cuckoo3 | yes | – | – | yes | yes |
| DRAKVUF-sandbox | yes | yes | – | partial | yes |
| FLARE-VM | n/a (workstation) | – | – | Win | yes |
| REMnux | n/a (workstation) | – | – | Lin | yes |
| ANY.RUN | yes | – | yes | yes | – (SaaS) |
| Joe Sandbox | yes | partial | – | yes (5 OS) | yes |
| VMRay | yes | yes | – | yes | yes |
| Hatching Triage | yes | – | – | yes | – (SaaS) |
| Hybrid Analysis | yes | – | – | yes | – (SaaS) |
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| CAPE | GPL-3.0-only | yes | OSS sandbox |
| Cuckoo3 | GPL-3.0-only | yes | OSS sandbox |
| DRAKVUF-sandbox | Apache-2.0 | yes | OSS agentless sandbox |
| FLARE-VM | Apache-2.0 | yes | OSS Windows analyst distro |
| REMnux | Mixed OSS | yes | OSS Linux analyst distro |
| ANY.RUN | Proprietary | – | Commercial SaaS (free tier) |
| Joe Sandbox | Proprietary | – | Commercial SaaS + on-prem |
| VMRay | Proprietary | – | Commercial SaaS + on-prem |
| Hatching Triage | Proprietary | – | Commercial SaaS (Recorded Future) |
| Hybrid Analysis | Proprietary | – | Free CrowdStrike service |
SSO / OIDC
| Tool | OIDC | SAML | SCIM | Notes |
|---|---|---|---|---|
| CAPE | plugin | none | none | Reverse-proxy auth |
| Cuckoo3 | plugin | none | none | Reverse-proxy auth |
| DRAKVUF-sandbox | plugin | none | none | Reverse-proxy auth |
| FLARE-VM | n/a | n/a | n/a | Analyst workstation |
| REMnux | n/a | n/a | n/a | Analyst workstation |
| ANY.RUN | paid | paid | paid | Enterprise tier |
| Joe Sandbox | paid | paid | paid | Enterprise tier |
| VMRay | paid | paid | paid | Enterprise tier |
| Hatching Triage | paid | paid | paid | Enterprise tier (Recorded Future) |
| Hybrid Analysis | paid | paid | none | Free public + CrowdStrike Enterprise |
Deployment Comparison
| Tool | Deployment | Resources | Notes |
|---|---|---|---|
| CAPE | KVM host (Ubuntu) | 8-32 CPU / 16-64 GB | Self-hosted bare-metal |
| Cuckoo3 | KVM host (Linux) | 8-32 CPU / 16-64 GB | Self-hosted bare-metal |
| DRAKVUF-sandbox | Xen-capable bare-metal | Heavy | Specialist deployment |
| FLARE-VM | Windows 10/11 VM | Workstation | Per-analyst |
| REMnux | Ubuntu VM | Workstation | Per-analyst |
| ANY.RUN | SaaS | – | – |
| Joe Sandbox | SaaS or on-prem appliance | Heavy on-prem | EU / regulated friendly |
| VMRay | SaaS or on-prem | Heavy on-prem | EU / regulated friendly |
| Hatching Triage | SaaS only | – | Recorded Future Cloud |
| Hybrid Analysis | SaaS only | – | CrowdStrike-hosted |
Composition Patterns
1. OSS-only on-prem stack
CAPE (primary) -- self-hosted detonation; config extraction
Cuckoo3 (parallel) -- alternative platform; comparison detonations
FLARE-VM -- Windows analyst workstation for static + deep analysis
REMnux -- Linux analyst workstation
+ MISP -- IOC pivoting + sharing (see tools/threat-intel/)
+ CAPE -> MISP push -- automated indicator flowOutput: full on-prem malware-analysis pipeline at zero license cost.
2. Hybrid OSS + SaaS triage
CAPE -- on-prem detonation for sensitive customer samples Hatching Triage / Hybrid Analysis -- public submission for routine triage ANY.RUN free tier -- interactive ad-hoc investigation FLARE-VM + REMnux -- analyst workstations
Output: mixed routine (SaaS) + sensitive (on-prem) processing. Standard MSSP / IR-practice pattern.
3. Commercial deep-analysis tier
Joe Sandbox or VMRay -- commercial on-prem for analyst-driven depth
FLARE-VM + REMnux -- analyst workstations
+ DRAKVUF for anti-analysis-aware samples (escalation)Output: highest-end analysis for sophisticated malware. Used when CAPE / Cuckoo3 evasion-resistance isn’t sufficient.
Cost Tier
Annual TCO for an in-house IR / malware- analysis practice.
| Tier | Tooling | Approx Cost |
|---|---|---|
| Free | CAPE + Cuckoo3 + DRAKVUF + FLARE-VM + REMnux + Hybrid Analysis | $0 + sandbox hardware + operator time |
| Mid | Add ANY.RUN paid tier or Hatching Triage paid tier | $5,000-30,000 / year |
| High | Add Joe Sandbox or VMRay on-prem | $50,000-200,000 / year |
Tools
10 tools.
ANY.RUN
Commercial interactive sandbox; analyst-controlled detonation in real time; popular freemium tier for community researchers.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
CAPE
Open-source malware-config-extraction sandbox; Cuckoo-derived, config-extraction focused, the most actively maintained OSS sandbox.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: direct, docker · SSO: OIDC
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
Cuckoo3
Open-source malware sandbox; ground-up Python 3 rewrite of the original Cuckoo Sandbox; Stichting Cuckoo Foundation.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: direct, docker · SSO: OIDC
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
DRAKVUF-sandbox
Open-source malware sandbox using Xen hypervisor + DRAKVUF library for agentless guest introspection; CERT.pl-developed.
License: Apache-2.0 (OSS) · Kind: web · Deploy: direct · SSO: OIDC
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
FLARE-VM
Mandiant FLARE team’s Windows-based malware analysis distribution; package installer for 100+ analyst tools.
License: Apache-2.0 (OSS) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
Hatching Triage
Commercial high-throughput SaaS sandbox; Recorded Future-acquired; cross-listed in tools/dfir/ as well.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
Hybrid Analysis
CrowdStrike Falcon Sandbox public service; free community submissions + CrowdStrike Intelligence-fed analysis; widely-used researcher tool.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on
Joe Sandbox
Swiss commercial malware sandbox; deepest analyst-driven analysis with hybrid code + behaviour inspection; on-prem available.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
REMnux
Lenny Zeltser-curated Linux distribution for malware analysis and IR; hundreds of pre-installed analyst tools.
License: LicenseRef-mixed-OSS (OSS) · Kind: desktop · Deploy: direct · SSO: none
ResorsIT usage: Deployment Payload
Access & Identity: Vaulted credential · Local host account
VMRay
German commercial sandbox using hypervisor-level Intel VT introspection; agentless guest analysis; popular in EU enterprises.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, direct · SSO: OIDC, SAML
ResorsIT usage: Web App with SSO
Access & Identity: Single sign-on · Provisioned account
