DRAKVUF Sandbox vs ThreatLab
DRAKVUF Sandbox
github.comThreatLab
threatlabsandbox.comSide by side
| Figure | DRAKVUF Sandbox | ThreatLab |
|---|---|---|
| Price from | — | $84/mo |
| Free plan | — | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 0 | 2 |
| Spec score · Malware Analysis Sandboxes | 7.7 (#9) | 7.5 (#13) |
| Maker | CERT Polska operates within NASK, Poland’s National Research Institute; its website lists an address in Warsaw, Poland, and says the team has been active since 1996. | The site identifies the maker as BrightByte Labs LLC. |
| Purpose | DRAKVUF Sandbox is an automated black-box malware analysis system powered by the DRAKVUF engine. | ThreatLab is a local malware analysis sandbox for security teams, with analysis running on hardware they control. |
Plans
In their own words
DRAKVUF Sandbox
DRAKVUF Sandbox is a free, GPL version 2 software project from CERT Polska for automated, black-box malware analysis. It uses the DRAKVUF engine and examines suspicious files without installing an agent inside the guest operating system. Files can be uploaded through a web interface, while an API, analysis queue, dashboard, Flask web application, rq worker and Redis support the workflow. Default plugins monitor WinAPI calls, file activity, memory regions, processes, network connections, DNS queries and TLS master keys. Reports show process trees, network and domain activity, modified or deleted files and high-level TTP indicators. Available downloads can include PCAP traffic, intercepted TLS keys and memory dumps. Uploads can disable guest internet access. On-premises deployment uses Xen 4.17 or later, with 4.19 recommended, on Debian 12 or Ubuntu 22.04 Intel hosts. Supported guests are Windows 10 x64 and Windows 7 x64.
ThreatLab
ThreatLab has no write-up on Specifiction yet; its figures are above.