Hatching Triage vs ReversingLabs Cloud Sandbox

Hatching Triage is a malware sandbox for automated analysis of files and URLs. It supports Windows 7 and 10, Linux, Android, and macOS analysis environments, and accepts more than 100 file types and archives. After unpacking and static analysis, it chooses a dynamic environment for detonation. Users can watch the analysis live and take control of its virtual machine. Reports surface relevant results, including extracted configurations for a growing number of malware families. Profiles preserve settings such as timeouts and internet configuration, and can specify a custom virtual machine. A REST API supports access to analysis data and workflow automation; a documented Cortex XSOAR integration can submit samples, retrieve results, and manage accounts and profiles. Individual users and researchers can use the public cloud for free. Hatching offers a private cloud demo on request, and says Triage can scale to 500,000 analyses per day. Its privacy policy says data is stored in the Netherlands and personal data is encrypted. Active-account data is retained indefinitely; after account deletion, submissions and reports remain, while uploader-linking fields are removed. Deleted data may remain in backups for up to 30 days.

ReversingLabs Cloud Sandbox executes files in isolated environments to observe runtime behavior and complement static analysis. It offers automatic analysis as well as interactive sessions where analysts can engage with a sample while it runs. Analysis supports Windows, macOS, Linux, and Android; Android is available for file submissions, not URL analysis.

Reports include network and behavioral indicators, process activity, registry and file changes, and downloadable artifacts. Files can be submitted through the Dynamic Analysis Submission API. The feature preview permits five samples per day, while full access is available at additional cost through ReversingLabs Sales Support. Individual samples can be up to 400 MB, and artifacts are available for download for one year. For private samples, other ReversingLabs customers may see results but not sample contents, dropped files, PCAP files, or memory string dumps. VPN routing is used when samples may connect to the internet. The service is intended for security operations teams handling incident response and threat hunting. ReversingLabs is headquartered in Cambridge, Massachusetts, and was founded in 2009.