Skip to content
SPECIFICTION
Get listed

DRAKVUF Sandbox

github.com

WebLinuxAPISelf-hosted
Visit github.com
Spec score 7.7 #9 of 27 in Malware Analysis Sandboxes

What it is

DRAKVUF Sandbox is a free, GPL version 2 software project from CERT Polska for automated, black-box malware analysis. It uses the DRAKVUF engine and examines suspicious files without installing an agent inside the guest operating system. Files can be uploaded through a web interface, while an API, analysis queue, dashboard, Flask web application, rq worker and Redis support the workflow. Default plugins monitor WinAPI calls, file activity, memory regions, processes, network connections, DNS queries and TLS master keys. Reports show process trees, network and domain activity, modified or deleted files and high-level TTP indicators. Available downloads can include PCAP traffic, intercepted TLS keys and memory dumps. Uploads can disable guest internet access. On-premises deployment uses Xen 4.17 or later, with 4.19 recommended, on Debian 12 or Ubuntu 22.04 Intel hosts. Supported guests are Windows 10 x64 and Windows 7 x64.

Spec sheet

Purpose
DRAKVUF Sandbox is an automated black-box malware analysis system powered by the DRAKVUF engine.Read 9 Oct 2026 · github.com
Intended users
The project warns that maintaining a sandbox is difficult and advises users to be prepared to debug issues that may depend on their configuration.Read 9 Oct 2026 · github.com
API
The documentation describes an API as part of the core workflow, alongside the analysis queue and dashboard.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Integrations
Optional integrations include S3 for analysis storage and an experimental Karton integration plugin in release v0.21.0.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Support
The maintainers list [email protected] as the fastest general contact and provide a Discord community link.Read 9 Oct 2026 · github.com
License
The license identifies DRAKVUF Sandbox as free software under GPL version 2 with stated clarifications and exceptions.Read 9 Oct 2026 · github.com
Headquarters
Warsaw, PolandRead 28 Sep 2026 · github.com
Maker
CERT Polska operates within NASK, Poland’s National Research Institute; its website lists an address in Warsaw, Poland, and says the team has been active since 1996.Read 9 Oct 2026 · cert.pl
Agentless analysis
The analysis process does not require an agent on the guest operating system.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Analysis interface
Its web interface lets users upload suspicious files and inspect analysis results to assess whether a file is malicious.Read 9 Oct 2026 · github.com
Analysis reports
Reports include process trees, network and domain activity, modified and deleted files, and high-level TTP indicators.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Analysis workflow
The documented stack includes a Flask-based web application, an rq-based worker, and Redis for communication between them.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Artifacts
Users can download recorded PCAP traffic, intercepted TLS keys, and memory dumps when available.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Behavior monitoring
Default plugins monitor WinAPI calls, file operations, memory regions, processes, network connections, DNS queries, and TLS master keys.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Cloud limitation
The documentation says cloud hosting is unsupported because required CPU features are not exposed, and Hyper-V does not work.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Guest systems
The documentation lists Windows 10 x64 and Windows 7 x64 as supported guest systems.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Host requirements
The documented host requirements include Debian 12 or Ubuntu 22.04, an Intel processor with VT-x and EPT, at least two CPU cores and 8 GB RAM, and GRUB.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Hypervisor
Xen 4.17 or later is required, with version 4.19 recommended; KVM is described as experimental.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Installation
The project provides an installation toolkit to guide users through setup, and experienced users can customize settings and infrastructure.Read 9 Oct 2026 · github.com
Network isolation
An upload option can disable internet access for the guest VM to help prevent samples from contacting external servers.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Optional storage
The documentation lists S3 integration as an optional feature.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Retention limit
The Analyses view remembers only the 100 most recent analyses, though all analyses remain reachable by ID.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Security model
The project describes itself as black-box analysis that does not require an agent inside the guest operating system.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Setup and support
The project provides an installation toolkit, recommends basic Xen knowledge, and lists [email protected] and a Discord channel for questions.Read 9 Oct 2026 · github.com
Supported guest
The documented guest systems are 64-bit Windows 10, with 22H2 recommended, and 64-bit Windows 7.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Supported host
The documented host systems are Debian 12 or Ubuntu 22.04 on Intel hardware with VT-x and EPT, at least two CPU cores and 8 GB RAM, and GRUB.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Virtualization limits
Cloud hosting is unsupported because required CPU features are not exposed, and Hyper-V does not work; KVM is considered experimental.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io
Web interface
Users can upload suspicious files through a web interface and review the resulting analysis reports.Read 9 Oct 2026 · drakvuf-sandbox.readthedocs.io

Strong points and limits

Strong points

  • Agentless guest analysis
  • Web uploads and analysis reports
  • Monitors network, DNS and TLS data
  • Downloadable PCAP and memory artifacts
  • Free open-source software

Limits

  • Cloud hosting is unsupported
  • Hyper-V does not work
  • Only 100 recent analyses shown in view
  • KVM is experimental

Who it suits

It suits malware analysts and security teams prepared to maintain an on-premises sandbox and debug configuration-dependent issues. Users need the documented Xen, Intel hardware and Windows guest environment.

Verdict

DRAKVUF Sandbox provides a detailed, agentless malware-analysis workflow with web access, API support and downloadable artifacts. Its strict host, hypervisor and guest requirements make deployment a specialist task.

Where Specifiction places it

Alternatives to DRAKVUF SandboxAll alternatives →