Malwagon

Malwagon is a cloud malware-analysis sandbox for people investigating suspicious files, links, commands and packages. It is best suited to incident responders, detection engineers and SOC teams that need behavioral evidence as well as outputs they can carry into security workflows. The free tiers offer a route to public triage, but private reports and meaningful scan capacity start with a paid plan.

Overview

Malwagon returns scored verdicts with evidence after examining submissions in isolated virtual machines. It accepts executables and archives up to 128 MB, URLs, PowerShell, CMD and bash commands, office and PDF documents, Windows kernel drivers, pip packages, and MD5, SHA-1 or SHA-256 hashes. That range is useful when an investigation begins with a link, script or package rather than a conventional executable.

Each analysis runs in its own full virtual machine under a kernel-level hypervisor, and that machine is discarded after the run. Samples stay on Malwagon-operated infrastructure. Third parties receive hashes and derived indicators for reputation lookups, while the AI layer receives locally derived summaries rather than sample bytes. These handling measures do not make the free tiers appropriate for confidential samples: their reports are public. Paid plans allow private reports, and Ultra Privacy deletes stored scan data after analysis.

Key features

Static analysis combines YARA checks, capability identification, recovery of obfuscated strings, packer and entropy checks, signature scanning, disassembly, secrets scanning and configuration extraction. Dynamic analysis adds ETW kernel telemetry, memory forensics, hypervisor introspection, network capture and JA3/JA4 fingerprints. Together, these methods give analysts both indicators from the sample itself and observations of its behavior, rather than relying on a verdict alone.

Reports can map activity to MITRE ATT&CK and generate YARA, Sigma and Suricata rules. Exports include ATT&CK Navigator, STIX 2.1, MISP, defanged IOC lists, PDF and DOCX, giving detection and response teams several ways to pass findings onward. A bearer-token REST API, an MCP server and a Python CLI provide workflow access; the CLI has no dependencies and runs on Linux, macOS and Windows.

Unauthenticated users can submit untrusted attachments and read reports, which lowers the barrier for basic triage. That convenience should be weighed against public report visibility on free tiers, particularly before submitting material that should not be exposed.

Pricing

The Free scan option costs nothing and allows three scans per source address per day, with Windows 10 22H2, no internet egress and public reports. It is suited to occasional basic checks, but the daily address-based cap and lack of network egress constrain repeated or network-dependent investigations.

Community is also free, billed Free, and provides 20 scan credits per month, 120-second runs, Windows 10 and Ubuntu 24.04, one concurrent scan and public reports. It gives regular users more monthly capacity and a Linux environment, but its short runs, single scan slot and public results make it a limited choice for team operations or sensitive samples.

Pro costs $79 a month, billed $790/yr billed yearly. It includes 200 scan credits per month, 300-second runs, all seven sandboxes, three concurrent scans, private reports, and REST API and MCP access. This is the sensible step up for individual analysts or small teams that need privacy and integrations. Business costs $199 a month, billed $1,990/yr billed yearly, and raises the allowance to 500 credits, run time to 600 seconds and concurrency to five; it retains all seven sandboxes, private reports and API/MCP access. The higher tier fits teams with more frequent or parallel investigations.

Team / Enterprise has custom pricing and includes 5,000 scan credits per month, 600-second runs, all seven sandboxes, ten concurrent scans, ten seats, a shared credit pool and organization reports. Its seat and shared-credit structure suits larger groups coordinating work across analysts. Pro and Business prices are stated monthly but billed yearly, so the annual billing terms matter when comparing them with the free tiers.

Platforms

Malwagon is a cloud service with API, Linux, macOS, web and Windows platforms. The CLI runs on Linux, macOS and Windows, and the REST API and MCP interface support programmatic access on paid Pro and Business plans. Windows and Ubuntu are also available analysis environments on the free Community tier; paid plans open all seven sandboxes.

Who it's for

Incident responders, detection engineers, SOC analysts and threat researchers are the clearest fit, especially when they need to analyze mixed submission types and convert findings into rules, indicators or structured exports. The REST API, MCP access and CLI are useful for teams incorporating analysis into existing processes. It is a weaker fit for anyone who needs private analysis without a paid plan, or whose free-tier work depends on internet egress, long runs or concurrent scans.

Pros and cons

• Broad submission support: Files, URLs, commands, documents, drivers, packages and hashes cover more than executable-only triage.
• Layered evidence: Static checks and detailed runtime telemetry give analysts multiple kinds of evidence behind a scored verdict.
• Actionable outputs: ATT&CK mappings, generated detection rules and several export formats help move analysis into response and detection work.
• Free analysis is public: Both free options expose reports publicly, making them unsuitable for sensitive submissions.
• Free limits are restrictive: Community caps users at 20 credits a month, 120-second runs and one concurrent scan, while Free scan is limited to three daily scans per source address and has no internet egress.
• Paid plans bill yearly: The monthly prices for Pro and Business come with annual billing, a material commitment for teams evaluating capacity.

Alternatives

Malware Analysis Sandboxes is a useful starting point for comparing this category. Choose ANY.RUN if its free Community plan's stated Windows, Android and Ubuntu environments or its free trial better match the evaluation need. Retrace may suit readers seeking a free community feed, standard execution queue, web interface, basic report export and unlimited public analyses.

CAPE Sandbox is the alternative to consider when open-source software and a self-hosted setup are the priority. Hybrid Analysis offers a free community service with 30 uploads per month and a 100 MB maximum upload size, for readers whose needs fit that quota and cap. Bitdefender Total Security is a different kind of choice: its listed Total Security Individual plan covers five devices under one account for $59.99 a year, billed at a first-year price plus applicable sales tax.

Hatching Triage is worth considering for organizations whose required analysis volume fits its volume-based packages, which start at 500 analyses per day and scale toward 50,000 per day. ReversingLabs Cloud Sandbox offers a feature preview limited to five samples per day, with full access at additional cost. SorbSecurity Cloud Sandbox is another alternative to compare.

Verdict

Malwagon is a strong choice for security teams that need varied submissions analyzed with both static and behavioral evidence, then exported or routed into detection workflows. Its clearest advantage is the combination of broad input support, detailed analysis and integrations. The main reason to look elsewhere is the boundary between free and paid use: free reports are public and tightly limited, while private analysis and higher capacity require paid plans billed yearly.