Skip to content
SPECIFICTION
Get listed

CAPE Sandbox

github.com

Free plan WebLinuxAPISelf-hosted
Visit github.com
Spec score 8.2 #7 of 26 in Sandbox Software

What it is

CAPE Sandbox is a free, open-source malware sandbox that executes malicious files in isolation while recording behavior and forensic artifacts. It captures API-hook activity, file changes, network traffic as PCAP, desktop screenshots, and full memory dumps. Malware classification can use YARA scans of unpacked payloads, Suricata scans of network captures, and behavioral signatures from API-hook output. CAPE also performs dynamic unpacking and extracts malware configuration through static and dynamic analysis. Its programmable debugger supports custom unpacking and configuration extractors, anti-sandbox countermeasures, and instruction traces. Configuration parsing works with CAPE’s framework and the listed RATDecoders, DC3-MWCP, MalDuck, and MaCo projects. Documentation covers a REST API, distributed deployment, and endpoints for tasks, reports, files, PCAPs, and machines. Additional integrations include Box-js, Curtain, LibreNMS, and Suricata. The project recommends Ubuntu 24.04 LTS, Windows 10 or Windows 11 23H2 targets, and KVM. Active unpacking is off by default because it may affect detonation quality.

Spec sheet

Purpose
CAPE is a malware sandbox that executes malicious files in an isolated environment while recording behavior and collecting forensic artifacts.Read 7 Oct 2026 · github.com
Intended users
The project invites contributions of signatures, parsers, and bypasses for additional malware families, indicating a community of malware analysts and researchers.Read 7 Oct 2026 · github.com
Founded
2016Read 28 Sep 2026 · github.com
Analysis output
Its core capabilities include API-hook behavioral instrumentation, file-change capture, PCAP network capture, malware classification, desktop screenshots, and full memory dumps.Read 7 Oct 2026 · github.com
API and distributed use
The documentation includes a REST API, distributed CAPE setup, and API endpoints for tasks, reports, files, PCAPs, and machines.Read 7 Oct 2026 · capev2.readthedocs.io
Classification
Malware classification can use YARA scans of unpacked payloads, Suricata scans of network captures, and behavioral signatures over API-hook output.Read 7 Oct 2026 · github.com
Debugger
A debugger programmable through YARA signatures supports custom unpacking and config extractors, anti-sandbox countermeasures, and instruction traces.Read 7 Oct 2026 · github.com
Deployment requirements
The project recommends Ubuntu 24.04 LTS for installation, Windows 10 or Windows 11 23H2 as the target, and KVM as the hypervisor.Read 7 Oct 2026 · github.com
Other integrations
The documentation lists integrations for Box-js, Curtain, LibreNMS, and Suricata.Read 7 Oct 2026 · capev2.readthedocs.io
Parser integrations
Configuration parsing supports CAPE's framework as well as RATDecoders, DC3-MWCP, MalDuck, and MaCo.Read 7 Oct 2026 · github.com
Security reporting
The repository security policy directs vulnerability reports to [email protected] or the CAPE Sandbox Twitter account.Read 7 Oct 2026 · github.com
Supported versions
The published security policy marks versions 5.1.x and 4.0.x as supported and 5.0.x and versions below 4.0 as unsupported.Read 7 Oct 2026 · github.com
Unpacking and extraction
CAPE adds automated dynamic malware unpacking and static and dynamic malware configuration extraction.Read 7 Oct 2026 · github.com
Unpacking limitation
Active unpacking is off by default because it may affect detonation quality.Read 7 Oct 2026 · github.com

Plans and prices

CAPE Sandbox Free Open-source project; self-hosted installation; free online demonstration instance Read 7 Oct 2026 · github.com

Every CAPE Sandbox plan and price →

Strong points and limits

Strong points

  • Free open-source self-hosted project
  • Captures behavior, PCAP, screenshots, and memory
  • Dynamic unpacking and configuration extraction
  • REST API and distributed deployment guidance
  • Supports YARA and Suricata classification

Limits

  • Active unpacking is disabled by default
  • Requires self-hosted deployment
  • Versions below 4.0 are unsupported

Who it suits

CAPE Sandbox is for malware analysts and researchers who need self-hosted isolated execution, forensic collection, unpacking, classification, and programmable analysis workflows. Its contribution model also suits communities developing signatures, parsers, and bypasses.

Verdict

CAPE Sandbox offers broad malware detonation, collection, unpacking, and classification capabilities with API and distributed-use documentation. Deployers should account for its recommended operating systems, hypervisor, and inactive-by-default unpacking.

Where Specifiction places it

Alternatives to CAPE SandboxAll alternatives →

E2B From $150/mo · Free plan 9.1 Visit