DRAKVUF Sandbox

Free plan APILinuxSelf-hostedWeb

What DRAKVUF Sandbox is

DRAKVUF Sandbox is a free, open-source system for automated black-box malware analysis, built around the DRAKVUF engine. It lets users upload suspicious files through a web interface and review analysis reports without installing an agent in the guest operating system. Its default monitoring covers WinAPI calls, file operations, memory regions, processes, network connections, DNS queries, and TLS master keys. Reports can include process trees, network and domain activity, changed or deleted files, and high-level TTP indicators. When available, users can download recorded PCAP traffic, intercepted TLS keys, and memory dumps. An upload option can disable internet access for the guest VM. The workflow includes a web application, analysis queue, dashboard, and API; S3 storage and an experimental Karton plugin in release v0.21.0 are optional integrations. Deployment is on premises. The documented setup requires Debian 12 or Ubuntu 22.04 on Intel hardware with VT-x and EPT, at least two CPU cores, 8 GB RAM, GRUB, and Xen 4.17 or later. Xen 4.19 is recommended. Supported guest systems are Windows 10 x64 and Windows 7 x64. Cloud hosting is unsupported, Hyper-V does not work, and KVM is experimental. The Analyses view remembers the 100 most recent analyses, while older analyses remain reachable by ID. CERT Polska, part of NASK, is based in Warsaw, Poland.

Who it suits

DRAKVUF Sandbox is for users who need to inspect suspicious files in a self-hosted, agentless malware analysis environment. It is best suited to people comfortable maintaining a sandbox and working with the documented Linux, Intel hardware, and Xen requirements.

What it does well

Agentless analysis uses the DRAKVUF engine.
Reports cover processes, network activity, file changes, and TTP indicators.
Can provide PCAP traffic, TLS keys, and memory dumps.
API is part of the analysis workflow.
GPL version 2 free software with optional S3 storage.

What to know first

Cloud hosting is unsupported and Hyper-V does not work.
KVM is experimental; Xen 4.17 or later is required.
Documented guests are limited to 64-bit Windows 10 and Windows 7.
The Analyses view remembers only the 100 latest analyses.

Limits

The documented environment requires Debian 12 or Ubuntu 22.04, Intel VT-x and EPT, and Xen 4.17 or later; cloud hosting is unsupported, Hyper-V does not work, and KVM is experimental. Supported guests are Windows 10 x64 and Windows 7 x64. The Analyses view retains only the 100 most recent items, although all analyses remain accessible by ID.

Getting started

Open the project at https://github.com/CERT-Polska/drakvuf-sandbox.
Prepare Debian 12 or Ubuntu 22.04 on supported Intel hardware with VT-x and EPT, GRUB, at least two CPU cores, and 8 GB RAM.
Set up Xen 4.17 or later; Xen 4.19 is recommended.
Use the installation toolkit to guide setup; basic Xen knowledge is recommended.
Configure a supported Windows 10 x64 or Windows 7 x64 guest.
Upload suspicious files through the web interface and review results in the dashboard or through the API.

Verdict

Choose DRAKVUF Sandbox if you need a free, self-hosted malware analysis system with agentless guest monitoring, reports, and an API. Its documented hardware and Xen requirements, unsupported cloud and Hyper-V hosting, and maintenance demands make it a less suitable choice for users who cannot manage that setup.

Questions

Is DRAKVUF Sandbox free?

Yes. It is free software under GPL version 2, with stated clarifications and exceptions.

Does it offer a free trial?

No free trial is listed; the pricing model is free.

What platforms does it support?

Listed platforms are API, Linux, self-hosted, and web. The documented host systems are Debian 12 or Ubuntu 22.04, and supported guests are Windows 10 x64 and Windows 7 x64.

Does it provide an API and integrations?

The API is part of the documented workflow. Optional integrations include S3 storage and an experimental Karton plugin in release v0.21.0.

Who makes DRAKVUF Sandbox?

CERT Polska operates within NASK, Poland’s National Research Institute. Its listed headquarters are in Warsaw, Poland.

What support is available?

The maintainers list [email protected] as the fastest general contact and provide a Discord community channel.

Facts from DRAKVUF Sandbox's own pages

Agentless analysis: The analysis process does not require an agent on the guest operating system. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Analysis interface: Its web interface lets users upload suspicious files and inspect analysis results to assess whether a file is malicious. · github.com, 9 Oct 2026
Analysis reports: Reports include process trees, network and domain activity, modified and deleted files, and high-level TTP indicators. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Analysis workflow: The documented stack includes a Flask-based web application, an rq-based worker, and Redis for communication between them. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
API: The documentation describes an API as part of the core workflow, alongside the analysis queue and dashboard. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Artifacts: Users can download recorded PCAP traffic, intercepted TLS keys, and memory dumps when available. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Behavior monitoring: Default plugins monitor WinAPI calls, file operations, memory regions, processes, network connections, DNS queries, and TLS master keys. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Cloud limitation: The documentation says cloud hosting is unsupported because required CPU features are not exposed, and Hyper-V does not work. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Guest systems: The documentation lists Windows 10 x64 and Windows 7 x64 as supported guest systems. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Headquarters: Warsaw, Poland · github.com, 28 Sept 2026
Host requirements: The documented host requirements include Debian 12 or Ubuntu 22.04, an Intel processor with VT-x and EPT, at least two CPU cores and 8 GB RAM, and GRUB. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Hypervisor: Xen 4.17 or later is required, with version 4.19 recommended; KVM is described as experimental. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Installation: The project provides an installation toolkit to guide users through setup, and experienced users can customize settings and infrastructure. · github.com, 9 Oct 2026
Integrations: Optional integrations include S3 for analysis storage and an experimental Karton integration plugin in release v0.21.0. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Intended users: The project warns that maintaining a sandbox is difficult and advises users to be prepared to debug issues that may depend on their configuration. · github.com, 9 Oct 2026
License: The license identifies DRAKVUF Sandbox as free software under GPL version 2 with stated clarifications and exceptions. · github.com, 9 Oct 2026
Maker: CERT Polska operates within NASK, Poland’s National Research Institute; its website lists an address in Warsaw, Poland, and says the team has been active since 1996. · cert.pl, 9 Oct 2026
Network isolation: An upload option can disable internet access for the guest VM to help prevent samples from contacting external servers. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Optional storage: The documentation lists S3 integration as an optional feature. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Purpose: DRAKVUF Sandbox is an automated black-box malware analysis system powered by the DRAKVUF engine. · github.com, 9 Oct 2026
Retention limit: The Analyses view remembers only the 100 most recent analyses, though all analyses remain reachable by ID. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Security model: The project describes itself as black-box analysis that does not require an agent inside the guest operating system. · drakvuf-sandbox.readthedocs.io, 9 Oct 2026
Setup and support: The project provides an installation toolkit, recommends basic Xen knowledge, and lists [email protected] and a Discord channel for questions. · github.com, 9 Oct 2026
Support: The maintainers list [email protected] as the fastest general contact and provide a Discord community link. · github.com, 9 Oct 2026

Where DRAKVUF Sandbox stands on Freedom251

Malware Analysis Sandboxes#7 of 27