DRAKVUF Sandbox vs ReversingLabs Cloud Sandbox
DRAKVUF Sandbox
github.com
ReversingLabs Cloud Sandbox
reversinglabs.comSide by side
| Figure | DRAKVUF Sandbox | ReversingLabs Cloud Sandbox |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| Android | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 0 | 1 |
| Spec score · Malware Analysis Sandboxes | 7.7 (#9) | 7.4 (#14) |
| API | The documentation describes an API as part of the core workflow, alongside the analysis queue and dashboard. | Files can be submitted directly to the Cloud Sandbox through the Dynamic Analysis Submission API. |
| Headquarters | Warsaw, Poland | Cambridge, Massachusetts, USA |
| Integrations | Optional integrations include S3 for analysis storage and an experimental Karton integration plugin in release v0.21.0. | ReversingLabs says its Malware Analysis and Threat Hunting portfolio supports integrations with TIP/SIEM/SOAR platforms, sandboxes, storage systems, email gateways, and web proxies, with APIs and SDKs for customization. |
| Intended users | The project warns that maintaining a sandbox is difficult and advises users to be prepared to debug issues that may depend on their configuration. | ReversingLabs describes Spectra Analyze as a malware analysis workbench for security operations teams handling incident response and threat hunting. |
| Support | The maintainers list [email protected] as the fastest general contact and provide a Discord community link. | ReversingLabs says each Malware Analysis and Threat Hunting product includes standard 9x5 support, with a premium 24x7 option available. |
Plans
ReversingLabs Cloud Sandbox
- ReversingLabs Cloud SandboxPriced on request
In their own words
DRAKVUF Sandbox
DRAKVUF Sandbox is a free, GPL version 2 software project from CERT Polska for automated, black-box malware analysis. It uses the DRAKVUF engine and examines suspicious files without installing an agent inside the guest operating system. Files can be uploaded through a web interface, while an API, analysis queue, dashboard, Flask web application, rq worker and Redis support the workflow. Default plugins monitor WinAPI calls, file activity, memory regions, processes, network connections, DNS queries and TLS master keys. Reports show process trees, network and domain activity, modified or deleted files and high-level TTP indicators. Available downloads can include PCAP traffic, intercepted TLS keys and memory dumps. Uploads can disable guest internet access. On-premises deployment uses Xen 4.17 or later, with 4.19 recommended, on Debian 12 or Ubuntu 22.04 Intel hosts. Supported guests are Windows 10 x64 and Windows 7 x64.
ReversingLabs Cloud Sandbox
ReversingLabs Cloud Sandbox executes files in isolated environments to observe runtime behavior and complement static analysis. It offers automatic analysis as well as interactive sessions where analysts can engage with a sample while it runs. Analysis supports Windows, macOS, Linux, and Android; Android is available for file submissions, not URL analysis.
Reports include network and behavioral indicators, process activity, registry and file changes, and downloadable artifacts. Files can be submitted through the Dynamic Analysis Submission API. The feature preview permits five samples per day, while full access is available at additional cost through ReversingLabs Sales Support. Individual samples can be up to 400 MB, and artifacts are available for download for one year. For private samples, other ReversingLabs customers may see results but not sample contents, dropped files, PCAP files, or memory string dumps. VPN routing is used when samples may connect to the internet. The service is intended for security operations teams handling incident response and threat hunting. ReversingLabs is headquartered in Cambridge, Massachusetts, and was founded in 2009.