CAPE Sandbox vs DRAKVUF Sandbox
CAPE Sandbox
capesandbox.comDRAKVUF Sandbox
github.comSide by side
| Figure | CAPE Sandbox | DRAKVUF Sandbox |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | Yes | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 0 |
| Spec score · Malware Analysis Sandboxes | 9.0 (#3) | 7.7 (#9) |
| Behavior monitoring | Windows analysis uses API-hook instrumentation and behavioral signatures. | Default plugins monitor WinAPI calls, file operations, memory regions, processes, network connections, DNS queries, and TLS master keys. |
| Integrations | The documentation covers integrations with Box-js, LibreNMS, and Suricata, and describes CAPE's modular design for integrating external services. | Optional integrations include S3 for analysis storage and an experimental Karton integration plugin in release v0.21.0. |
| Purpose | CAPE is an open-source malware sandbox that runs suspicious files in an isolated environment while monitoring behavior and collecting forensic artifacts. | DRAKVUF Sandbox is an automated black-box malware analysis system powered by the DRAKVUF engine. |
| Support | The project points users to its FAQ, community discussion, and GitHub issue tracker, and says beta or development builds generally do not receive support. | The maintainers list [email protected] as the fastest general contact and provide a Discord community link. |
| Web interface | The Django web interface supports submitting files, browsing reports, and searching analysis results. | Users can upload suspicious files through a web interface and review the resulting analysis reports. |
Plans
In their own words
CAPE Sandbox
CAPE Sandbox is an open-source malware analysis tool that runs suspicious files in isolated virtual machines, monitors their behavior, and collects forensic artifacts. It can record execution activity, files created or changed, network traffic in PCAP format, screenshots, and memory dumps. CAPE also performs dynamic malware unpacking, applies YARA classification to unpacked payloads, and extracts malware configurations through static and dynamic analysis.
Documented analysis targets include Windows executables and DLLs, PDFs, Office files, URLs, HTML, scripts, ZIP files, and Java JARs. A debugger can use YARA signatures for custom unpacking and configuration extractors, anti-sandbox countermeasures, and instruction traces. The Django web interface supports submissions, report browsing, and searching results; a REST API and Python functions support automated file and URL analysis. Setup requires host and guest machines, with each analysis run in a fresh virtual machine. GNU/Linux, preferably Ubuntu LTS, is the recommended host, and Windows 10 or Windows 11 23H2 the recommended guest. CAPE is free and self-hosted, and is distributed without warranty.
DRAKVUF Sandbox
DRAKVUF Sandbox is a free, GPL version 2 software project from CERT Polska for automated, black-box malware analysis. It uses the DRAKVUF engine and examines suspicious files without installing an agent inside the guest operating system. Files can be uploaded through a web interface, while an API, analysis queue, dashboard, Flask web application, rq worker and Redis support the workflow. Default plugins monitor WinAPI calls, file activity, memory regions, processes, network connections, DNS queries and TLS master keys. Reports show process trees, network and domain activity, modified or deleted files and high-level TTP indicators. Available downloads can include PCAP traffic, intercepted TLS keys and memory dumps. Uploads can disable guest internet access. On-premises deployment uses Xen 4.17 or later, with 4.19 recommended, on Debian 12 or Ubuntu 22.04 Intel hosts. Supported guests are Windows 10 x64 and Windows 7 x64.