License & Deployment Mix: 10 tools – 5 OSS (3 sandboxes + 2 analyst workstation distros), 5 commercial.

Color: Blue team.

What Is This Category?

A malware analysis sandbox runs an untrusted file (executable, document, archive, URL) in an isolated, fully-instrumented VM and records everything the file does: file system, registry, network, API calls, child processes, child URLs. The output is a structured report that an analyst (or SOAR playbook) can consume to decide block / allow / hunt.

This category also includes analyst-workstation distros (FLARE-VM, REMnux) that are sandbox- adjacent. They aren’t themselves sandboxes but the malware-analysis workflow uses them constantly: the captured artefacts get analysed on FLARE-VM or REMnux after sandbox detonation.

Distinct from neighbouring categories

• EDR / XDR – EDR detects behaviour on real endpoints; sandbox detonates in isolation to characterise the artefact before it lands
• Digital Forensics & IR (DFIR) – DFIR investigates what an attacker did; sandbox tells you what the attacker’s tool does
• Reverse Engineering / Binary Analysis – RE is manual deep-dive on a specific sample; sandbox is automated triage across many samples

The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.

Comparison

Category Scope

Malware sandbox is split between detonation platforms (CAPE, Cuckoo3, DRAKVUF-sandbox, Joe Sandbox, VMRay, ANY.RUN, Triage, Hybrid Analysis) and analyst-workstation distros (FLARE-VM, REMnux) that are sandbox-adjacent. Both are included in this category because the analyst workflow spans them: a sample gets detonated in a sandbox, the captured artefacts get analysed on FLARE-VM / REMnux, and the IOCs go into the TIP.

The Hatching Triage entry cross-references Digital Forensics & IR (DFIR). It appears in both categories because the tool fits both – the dfir entry emphasises IR / indicator- extraction workflow; this entry emphasises sandbox classification.

Capability Matrix

License Comparison

SSO / OIDC

Deployment Comparison

Composition Patterns

1. OSS-only on-prem stack

CAPE (primary) -- self-hosted detonation; config extraction
Cuckoo3 (parallel) -- alternative platform; comparison detonations
FLARE-VM -- Windows analyst workstation for static + deep analysis
REMnux -- Linux analyst workstation
+ MISP -- IOC pivoting + sharing (see tools/threat-intel/)
+ CAPE -> MISP push -- automated indicator flow

Output: full on-prem malware-analysis pipeline at zero license cost.

2. Hybrid OSS + SaaS triage

CAPE -- on-prem detonation for sensitive customer samples Hatching Triage / Hybrid Analysis -- public submission for routine triage ANY.RUN free tier -- interactive ad-hoc investigation FLARE-VM + REMnux -- analyst workstations

Output: mixed routine (SaaS) + sensitive (on-prem) processing. Standard MSSP / IR-practice pattern.

3. Commercial deep-analysis tier

Joe Sandbox or VMRay -- commercial on-prem for analyst-driven depth
FLARE-VM + REMnux -- analyst workstations
+ DRAKVUF for anti-analysis-aware samples (escalation)

Output: highest-end analysis for sophisticated malware. Used when CAPE / Cuckoo3 evasion-resistance isn’t sufficient.

Cost Tier

Annual TCO for an in-house IR / malware- analysis practice.

Tools

10 tools.

ANY.RUN

Commercial interactive sandbox; analyst-controlled detonation in real time; popular freemium tier for community researchers.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

CAPE

Open-source malware-config-extraction sandbox; Cuckoo-derived, config-extraction focused, the most actively maintained OSS sandbox.

License: GPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: OIDC

Website · Source

Cuckoo3

Open-source malware sandbox; ground-up Python 3 rewrite of the original Cuckoo Sandbox; Stichting Cuckoo Foundation.

License: GPL-3.0-only (OSS) · Kind: web · Deploy: native, docker · SSO: OIDC

Website · Source

DRAKVUF-sandbox

Open-source malware sandbox using Xen hypervisor + DRAKVUF library for agentless guest introspection; CERT.pl-developed.

License: Apache-2.0 (OSS) · Kind: web · Deploy: native · SSO: OIDC

Website · Source

FLARE-VM

Mandiant FLARE team’s Windows-based malware analysis distribution; package installer for 100+ analyst tools.

License: Apache-2.0 (OSS) · Kind: desktop · Deploy: native · SSO: none

Website · Source

Hatching Triage

Commercial high-throughput SaaS sandbox; Recorded Future-acquired; cross-listed in tools/dfir/ as well.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

Hybrid Analysis

CrowdStrike Falcon Sandbox public service; free community submissions + CrowdStrike Intelligence-fed analysis; widely-used researcher tool.

License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML

Website

Joe Sandbox

Swiss commercial malware sandbox; deepest analyst-driven analysis with hybrid code + behaviour inspection; on-prem available.

License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: OIDC, SAML

Website

REMnux

Lenny Zeltser-curated Linux distribution for malware analysis and IR; hundreds of pre-installed analyst tools.

License: LicenseRef-mixed-OSS (OSS) · Kind: desktop · Deploy: native · SSO: none

Website · Source

VMRay

German commercial sandbox using hypervisor-level Intel VT introspection; agentless guest analysis; popular in EU enterprises.

License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: OIDC, SAML

Website