DRAKVUF Sandbox vs Hatching Triage

DRAKVUF Sandbox is a free, GPL version 2 software project from CERT Polska for automated, black-box malware analysis. It uses the DRAKVUF engine and examines suspicious files without installing an agent inside the guest operating system. Files can be uploaded through a web interface, while an API, analysis queue, dashboard, Flask web application, rq worker and Redis support the workflow. Default plugins monitor WinAPI calls, file activity, memory regions, processes, network connections, DNS queries and TLS master keys. Reports show process trees, network and domain activity, modified or deleted files and high-level TTP indicators. Available downloads can include PCAP traffic, intercepted TLS keys and memory dumps. Uploads can disable guest internet access. On-premises deployment uses Xen 4.17 or later, with 4.19 recommended, on Debian 12 or Ubuntu 22.04 Intel hosts. Supported guests are Windows 10 x64 and Windows 7 x64.

Hatching Triage is a malware sandbox for automated analysis of files and URLs. It supports Windows 7 and 10, Linux, Android, and macOS analysis environments, and accepts more than 100 file types and archives. After unpacking and static analysis, it chooses a dynamic environment for detonation. Users can watch the analysis live and take control of its virtual machine. Reports surface relevant results, including extracted configurations for a growing number of malware families. Profiles preserve settings such as timeouts and internet configuration, and can specify a custom virtual machine. A REST API supports access to analysis data and workflow automation; a documented Cortex XSOAR integration can submit samples, retrieve results, and manage accounts and profiles. Individual users and researchers can use the public cloud for free. Hatching offers a private cloud demo on request, and says Triage can scale to 500,000 analyses per day. Its privacy policy says data is stored in the Netherlands and personal data is encrypted. Active-account data is retained indefinitely; after account deletion, submissions and reports remain, while uploader-linking fields are removed. Deleted data may remain in backups for up to 30 days.