DRAKVUF Sandbox vs VirusTotal Intelligence
DRAKVUF Sandbox
github.comVirusTotal Intelligence
virustotal.comSide by side
| Figure | DRAKVUF Sandbox | VirusTotal Intelligence |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 0 | 2 |
| Spec score · Malware Analysis Sandboxes | 7.7 (#9) | 6.5 (#19) |
| Integrations | Optional integrations include S3 for analysis storage and an experimental Karton integration plugin in release v0.21.0. | VirusTotal documents third-party integrations for security workflows including alert triage, event enrichment, false-positive discarding, detection, and response. |
| Intended users | The project warns that maintaining a sandbox is difficult and advises users to be prepared to debug issues that may depend on their configuration. | The maker describes premium services as tools for qualified customers and antivirus partners to search for and access harmful file samples for further study. |
| Support | The maintainers list [email protected] as the fastest general contact and provide a Discord community link. | The maker directs users seeking pricing information to contact VirusTotal with their use case and usage estimates for a quote. |
Plans
VirusTotal Intelligence
- Standard tiersPriced on request
- Threat Hunter PROPriced on request
In their own words
DRAKVUF Sandbox
DRAKVUF Sandbox is a free, GPL version 2 software project from CERT Polska for automated, black-box malware analysis. It uses the DRAKVUF engine and examines suspicious files without installing an agent inside the guest operating system. Files can be uploaded through a web interface, while an API, analysis queue, dashboard, Flask web application, rq worker and Redis support the workflow. Default plugins monitor WinAPI calls, file activity, memory regions, processes, network connections, DNS queries and TLS master keys. Reports show process trees, network and domain activity, modified or deleted files and high-level TTP indicators. Available downloads can include PCAP traffic, intercepted TLS keys and memory dumps. Uploads can disable guest internet access. On-premises deployment uses Xen 4.17 or later, with 4.19 recommended, on Debian 12 or Ubuntu 22.04 Intel hosts. Supported guests are Windows 10 x64 and Windows 7 x64.
VirusTotal Intelligence
VirusTotal Intelligence has no write-up on Specifiction yet; its figures are above.