Skip to content
SPECIFICTION
Get listed

Malwagon

malwagon.com

From $79/mo Free plan WebWindowsmacOSLinuxAPI
Visit malwagon.com
Spec score 9.0 #4 of 27 in Malware Analysis Sandboxes

What it is

Malwagon is a cloud-based malware analysis sandbox that examines files, URLs, commands, documents, packages, hashes and Windows kernel drivers in isolated virtual machines. It returns scored verdicts with evidence. Static analysis includes YARA, capability identification, obfuscated-string recovery, packer and entropy checks, signature scanning, disassembly, secrets scanning and configuration extraction. Dynamic analysis records ETW kernel telemetry, memory forensics, hypervisor introspection, network traffic and JA3/JA4 fingerprints. Reports can include MITRE ATT&CK mappings and generated YARA, Sigma and Suricata rules, with exports including ATT&CK Navigator, STIX 2.1, MISP, PDF and DOCX. Accepted executables and archives can be up to 128 MB. Each run uses its own full virtual machine, discarded afterward. Samples stay on Malwagon-operated infrastructure; third parties receive hashes and derived indicators for reputation lookups. Free-tier reports are public, while paid plans can keep scans private. Pro costs $79 a month, billed $790/yr billed yearly, and includes 200 scan credits per month, private reports, REST API and MCP access.

Spec sheet

What it does
Malwagon analyzes files, URLs, commands, documents, packages, hashes and Windows kernel drivers in isolated virtual machines and returns scored verdicts with evidence.Read 15 Oct 2026 · malwagon.com
Integrations
The service provides a bearer-token REST API, an MCP server at https://malwagon.com/mcp, and a Python CLI installable with pip.Read 30 Sep 2026 · malwagon.com
Support
Platform, plan and report questions are directed to the contact page and the email address published on the site.Read 15 Oct 2026 · malwagon.com
Account security
The service documents 12-character minimum passwords, TOTP two-factor authentication, sign-in rate limiting and revocable API tokens.Read 15 Oct 2026 · malwagon.com
AI data boundary
The AI narrative receives locally derived summaries, API-call sequences, indicators and extracted strings rather than sample bytes.Read 15 Oct 2026 · malwagon.com
Analysis layers
Static analysis includes YARA, capability identification, obfuscated-string recovery, packer and entropy checks, signature scanning, disassembly, secrets scanning and configuration extraction.Read 30 Sep 2026 · malwagon.com
API upload limit
The API has a file-upload route, but the documentation says the MCP server cannot upload bytes and other API submissions name targets as text.Read 15 Oct 2026 · malwagon.com
CLI
The Python CLI installs with pip, has no dependencies, runs on Linux, macOS and Windows, and returns exit codes for clean, malicious, suspicious and error results.Read 15 Oct 2026 · pypi.org
CLI licence
The PyPI package identifies itself as MIT licensed and OSI-approved.Read 15 Oct 2026 · pypi.org
CLI maintainer
PyPI lists one maintainer, zecrain, and credits Malwagon as the author.Read 15 Oct 2026 · pypi.org
CLI platforms
The Malwagon CLI has no dependencies and runs on Linux, macOS and Windows.Read 30 Sep 2026 · malwagon.com
CLI release
PyPI lists version 0.1.3 uploaded on September 7, 2026, with a 0.1.2 release also dated September 7, 2026.Read 15 Oct 2026 · pypi.org
CLI runtime
The PyPI package requires Python 3.8 or newer and is classified for Windows, macOS, Linux/POSIX and Python 3.Read 15 Oct 2026 · pypi.org
Command analysis
Command analysis executes PowerShell, CMD and bash text after local decoding of common obfuscation forms.Read 15 Oct 2026 · malwagon.com
Company founding
No founding year is stated on the reviewed official pages or the PyPI project page.Read 15 Oct 2026 · malwagon.com
Company headquarters
No headquarters location is stated on the reviewed official pages or the PyPI project page.Read 15 Oct 2026 · malwagon.com
Data handling
Malwagon says submitted samples stay on its infrastructure; external reputation services receive only hashes and derived indicators.Read 15 Oct 2026 · malwagon.com
Detection outputs
Reports can export ATT&CK Navigator, STIX 2.1, MISP, defanged IOC, PDF and DOCX formats, plus generated YARA, Sigma and Suricata rules.Read 15 Oct 2026 · malwagon.com
Document analysis
Document analysis opens Office, PDF, RTF, OneNote, CHM and web-container formats in the application that owns the format.Read 15 Oct 2026 · malwagon.com
Documentation depth
The documentation covers submission modules, analysis options, report interpretation, exports, visibility, retention, REST endpoints, MCP methods, errors and rate limits.Read 15 Oct 2026 · malwagon.com
Dynamic analysis
Dynamic analysis records ETW kernel telemetry, memory forensics, hypervisor introspection, network capture and JA3/JA4 fingerprints.Read 30 Sep 2026 · malwagon.com
File analysis
File analysis supports PE, DLL, .NET, ELF, Go, scripts and archives up to 128 MB, with static and dynamic analysis.Read 15 Oct 2026 · malwagon.com
Hypervisor isolation
Each analysis runs in its own full virtual machine under a kernel-level hypervisor, and the machine is discarded after the run.Read 30 Sep 2026 · malwagon.com
Internet egress
Internet-connected detonation is a paid-plan, per-scan option; anonymous and Community runs remain network isolated.Read 15 Oct 2026 · malwagon.com
Isolation
Each analysis runs in its own virtual machine under a kernel-level hypervisor and the machine is discarded after the run.Read 15 Oct 2026 · malwagon.com
Kernel-driver analysis
Windows kernel drivers receive static BYOVD analysis covering their control interface, signing and known-abuse status; they are not kernel-detonated.Read 15 Oct 2026 · malwagon.com
Limit: no bug bounty
Malwagon states that it has no bug-bounty programme and offers no reward for vulnerability reports.Read 15 Oct 2026 · malwagon.com
Limit: no CSV or video export
The documentation states that reports have no CSV export and no video export; screen captures are replayed in the browser timeline.Read 15 Oct 2026 · malwagon.com
Limit: no self-hosting stated
The reviewed maker pages describe Malwagon as running on hardware the team operates and do not document a self-hosted deployment option.Read 15 Oct 2026 · malwagon.com
Limit: package scope
Package analysis accepts one requirement per scan and refuses requirements files, repository references, URLs and local paths.Read 15 Oct 2026 · malwagon.com
Limit: public free reports
Anonymous and Community reports are publicly viewable; private visibility begins with Pro, Business or Team/Enterprise.Read 15 Oct 2026 · malwagon.com
Maker identity
The PyPI project names Malwagon as author, while the website copyright identifies the product simply as Malwagon.Read 15 Oct 2026 · pypi.org
MCP server
Malwagon exposes a JSON-RPC MCP server at /mcp, using protocol revision 2026-07-28 and requiring a paid plan.Read 15 Oct 2026 · malwagon.com
OneShot
OneShot runs one uploaded sample across selected Windows images and returns screenshots without static, dynamic, intelligence or AI layers.Read 15 Oct 2026 · malwagon.com
Package analysis
Package analysis installs one Python package requirement inside a disposable Linux VM under syscall tracing.Read 15 Oct 2026 · malwagon.com
Report visibility
Free-tier reports are publicly viewable, while paid plans can keep scans private and Ultra Privacy deletes stored scan data after analysis.Read 30 Sep 2026 · malwagon.com
REST API
The public API uses bearer authentication and provides seven JSON routes under /api/v1 for scans, uploads, bulk submission, status, reports, indicators and hashes.Read 15 Oct 2026 · malwagon.com
Sample data handling
Submitted samples stay on Malwagon-operated infrastructure; third parties receive only hashes and derived indicators for reputation lookups, while the AI layer receives locally derived summaries rather than sample bytes.Read 30 Sep 2026 · malwagon.com
Support and disclosure
Platform questions, vulnerability reports and takedown requests are handled through the contact page and [email protected]; Malwagon states that it has no bug-bounty program.Read 30 Sep 2026 · malwagon.com
Supported submissions
The platform accepts executables and archives up to 128 MB, URLs, PowerShell/CMD/bash commands, office and PDF documents, Windows kernel drivers, pip packages and MD5/SHA-1/SHA-256 hashes.Read 30 Sep 2026 · malwagon.com
Telemetry
Dynamic analysis records ETW kernel telemetry, memory forensics, hypervisor introspection, network capture and JA3/JA4 fingerprints.Read 15 Oct 2026 · malwagon.com
Ultra Privacy
Ultra Privacy deletes sample bytes, artifacts, analysis records, indicators, traffic captures and the prepared report after analysis.Read 15 Oct 2026 · malwagon.com
URL analysis
URL analysis uses a real headless browser in a disposable Linux guest and records navigation screenshots and response bodies.Read 15 Oct 2026 · malwagon.com
Who it is for
Malwagon is designed for incident responders, detection engineers, SOC analysts and threat researchers, while unauthenticated users can submit untrusted attachments and read reports.Read 30 Sep 2026 · malwagon.com

Plans and prices

Community Free 20 scan credits/month · 120-second runs · Windows 10 and Ubuntu 24.04 · 1 concurrent scan · public reports Read 15 Oct 2026 · malwagon.com
Free scan Free 3 scans per source address per day · Windows 10 22H2 · network isolated · public report · no account Read 15 Oct 2026 · malwagon.com
Pro $79 a month $79/mo; $790/yr billed yearly 200 credits/month · 300-second runs · 7 sandboxes · 3 concurrent scans · private reports · API and MCP Read 15 Oct 2026 · malwagon.com
Business $199 a month $199/mo; $1,990/yr billed yearly 500 credits/month · 600-second runs · 7 sandboxes · 5 concurrent scans · private reports · API and MCP Read 15 Oct 2026 · malwagon.com
Team / Enterprise Priced on request 5,000 credits/month · 600-second runs · 7 sandboxes · 10 concurrent scans · 10 seats · shared pool · role management Read 15 Oct 2026 · malwagon.com

Every Malwagon plan and price →

Strong points and limits

Strong points

  • Analyzes files, URLs, commands and packages.
  • Isolates each analysis in a virtual machine.
  • Reports can include ATT&CK mappings and detection rules.
  • REST API and MCP access are included in Pro.

Limits

  • Free-tier reports are public.
  • Free Scan allows three scans per source address daily.
  • Pro costs $79 a month.
  • Executables and archives are limited to 128 MB.

Who it suits

Malwagon is designed for incident responders, detection engineers, SOC analysts and threat researchers. Unauthenticated users can also submit untrusted attachments and read reports.

Verdict

Malwagon covers static and dynamic analysis and provides structured exports for investigation workflows. Consider report privacy and the scan-credit limits when selecting a plan.

Where Specifiction places it

Alternatives to MalwagonAll alternatives →