DRAKVUF Sandbox vs SorbSecurity Cloud Sandbox
DRAKVUF Sandbox
github.comSorbSecurity Cloud Sandbox
sorbsecurity.comSide by side
| Figure | DRAKVUF Sandbox | SorbSecurity Cloud Sandbox |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| Linux | Yes | — |
| Android | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 0 |
| Spec score · Malware Analysis Sandboxes | 7.7 (#9) | 7.5 (#12) |
| API | The documentation describes an API as part of the core workflow, alongside the analysis queue and dashboard. | SCS exposes a REST API for file and URL analysis, task searches, reports, indicators of compromise, screenshots, and PCAP downloads. |
| Headquarters | Warsaw, Poland | Singapore |
| Integrations | Optional integrations include S3 for analysis storage and an experimental Karton integration plugin in release v0.21.0. | The datasheet names FortiGate, FortiMail, FortiWeb, FortiADC, FortiProxy, and FortiClient ATP agent integrations. |
| Intended users | The project warns that maintaining a sandbox is difficult and advises users to be prepared to debug issues that may depend on their configuration. | The datasheet says SCS is scalable for large organizations and can enrich custom applications and existing security tools. |
| Maker | CERT Polska operates within NASK, Poland’s National Research Institute; its website lists an address in Warsaw, Poland, and says the team has been active since 1996. | The product datasheet identifies SorbSecurity Cloud Sandbox as a SorbSecurity product; the maker's site footer names Sorb Security Pte Ltd. |
| Purpose | DRAKVUF Sandbox is an automated black-box malware analysis system powered by the DRAKVUF engine. | SorbSecurity Cloud Sandbox (SCS) analyzes suspicious files in an isolated environment to identify threats. |
| Support | The maintainers list [email protected] as the fastest general contact and provide a Discord community link. | The maker directs SCS inquiries to [email protected] and lists a contact address in Singapore. |
In their own words
DRAKVUF Sandbox
DRAKVUF Sandbox is a free, GPL version 2 software project from CERT Polska for automated, black-box malware analysis. It uses the DRAKVUF engine and examines suspicious files without installing an agent inside the guest operating system. Files can be uploaded through a web interface, while an API, analysis queue, dashboard, Flask web application, rq worker and Redis support the workflow. Default plugins monitor WinAPI calls, file activity, memory regions, processes, network connections, DNS queries and TLS master keys. Reports show process trees, network and domain activity, modified or deleted files and high-level TTP indicators. Available downloads can include PCAP traffic, intercepted TLS keys and memory dumps. Uploads can disable guest internet access. On-premises deployment uses Xen 4.17 or later, with 4.19 recommended, on Debian 12 or Ubuntu 22.04 Intel hosts. Supported guests are Windows 10 x64 and Windows 7 x64.
SorbSecurity Cloud Sandbox
SorbSecurity Cloud Sandbox analyzes suspicious files in isolated environments using static and dynamic evaluation. Dynamic analysis simulates real-world scenarios to examine file behavior, while behavioral analytics seek threats that may exploit unknown vulnerabilities. The product provides visual reports covering identified threats, behavior, and response actions. Listed analysis environments include Windows and Android virtual systems, with anti-evasion methods, callback detection, interactive sandbox mode, and capture of packets, original files, tracer logs, and screenshots. Supported file types include APK, DOC/DOCX, EML, EXE, ISO, PDF, PowerPoint, scripts, and archives; the customer agreement sets a 100M maximum file size. A REST API handles file and URL analysis, task searches, reports, indicators of compromise, screenshots, and PCAP downloads. Request-rate and total-request limits apply under the terms of service. SCS integrates with firewalls, antivirus, endpoint protection, and named Fortinet products. On-premise deployment supports high-availability clustering and GUI or CLI configuration. The listed price starts at $3/user/mo with a 30-day trial.