Malwagon is a cloud malware-analysis sandbox that examines files, URLs, commands, documents, packages and Windows kernel drivers in isolated virtual machines. It returns scored verdicts with evidence for security investigation. Static analysis includes YARA checks, capability identification, obfuscated-string recovery, packer and entropy checks, signature scanning, disassembly, secrets scanning and configuration extraction. Dynamic analysis records kernel telemetry, memory forensics, hypervisor introspection, network traffic and JA3/JA4 fingerprints. Reports can include MITRE ATT&CK mappings and generated YARA, Sigma and Suricata rules, with exports such as ATT&CK Navigator, STIX 2.1, MISP, PDF and DOCX. Each run gets its own full virtual machine, which is discarded afterward. Submitted samples stay on Malwagon-operated infrastructure; third parties receive hashes and derived indicators for reputation checks, and the AI layer receives locally derived summaries rather than sample bytes. Free-tier reports are public, while paid plans can keep scans private. The service has a REST API, an MCP server and a Python CLI. Pro starts at 79.00 USD per month.
Who it is for
It is designed for incident responders, detection engineers, SOC analysts and threat researchers. Unauthenticated users can also submit untrusted attachments and read reports.
What is good
- Analyzes files, URLs, commands and packages.
- Each run uses a separate virtual machine.
- Reports can include ATT&CK mappings and detection rules.
- Offers REST API, MCP server and Python CLI.
- Paid plans can keep scan reports private.
What to know first
- Free-tier reports are publicly viewable.
- Free scan plan allows three scans per source address daily.
- Free scan plan has no internet egress.
- Accepted executables and archives are limited to 128 MB.
Verdict
Malwagon combines static and dynamic analysis with evidence-rich reports and several export formats. Review report visibility, scan allowances and plan limits before submitting sensitive samples.
Malwagon plans and pricing
All plansCompared on malware analysis sandboxes
- Free plan
- Yes
- Paid from
- $79/mo
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
- File size limit
- 128 MB
- Deployment model
- cloud
