Instead of Retrace
Retrace alternatives
Retrace is built for investigating suspicious software in interactive, disposable virtual machines across Windows, macOS, Linux, and Android. It records file writes, registry activity, network packets, and process launches; its AI copilot answers questions with citations to trace events, techniques, and captured files. Each run is compared with the user’s sandbox corpus, and answers can be exported as Markdown, PDF, or STIX 2.1. The free Community tier offers web access and basic report export, while higher tiers add private submissions, APIs, team controls, and dedicated or air-gapped deployment options.
- 1
ANY.RUN
Free plan AndroidAPIExtension+5Real-time browser-based analysis and threat intelligence — ANY.RUN adds live browser interaction and threat intelligence drawn from millions of sandbox investigations.
- 2
Malwagon
Free plan APILinuxMac+2Automated file, URL, command, and package analysis — Malwagon adds broad static analysis, generated detection rules, and many submission types, while Retrace centers on interactive sandboxes and AI trace questions.
- 3
CAPE Sandbox
Free plan Open source APILinuxSelf-hosted+2Open-source, self-hosted malware analysis — CAPE is open source and adds automated unpacking, configuration extraction, and a programmable debugger.
- 4
Detonate
Free plan APILinuxSelf-hosted+1Software supply-chain checks in CI/CD — Detonate analyzes software dependencies in micro-VMs and returns policy verdicts rather than focusing on general malware investigation.
- 5
Hybrid Analysis
Free plan APIWebFree community analysis and IOC search — Hybrid Analysis offers static and dynamic file analysis plus YARA, string, report, and IOC search, with a 30-upload monthly limit.
- 6
Bitdefender Total Security
by Bitdefender Total SecurityFree plan AndroidiPhoneMac+1Multi-device consumer security — Bitdefender Total Security provides complete security and ransomware protection for up to 25 devices, not a malware-analysis sandbox.
From $59.99/yr · 30-day trial Visit site - 7
Hatching Triage
Free plan AndroidAPILinux+4High-volume automated malware analysis — Hatching Triage supports over 100 file types, real-time detonation control, and claimed scale of 500,000 analyses per day.
- 8
DRAKVUF Sandbox
Free plan APILinuxSelf-hosted+1 - 9
CrowdStrike Falcon Pro
Free trial AndroidAPIiPhone+4 - 10
Cisco Catalyst Center
Paid APILinuxMac+3 - 11
Kaspersky Research Sandbox
Paid AndroidAPILinux+3 - 12
ThreatLab
Free trial WebWindows - 13
ReversingLabs Cloud Sandbox
Paid AndroidAPILinux+3 - 14
Symantec IT Management Suite
Paid APILinuxMac+3 - 15
FortiSandbox
Paid Self-hostedWeb - 16
SorbSecurity Cloud Sandbox
Paid AndroidAPISelf-hosted+2 - 17
ThreatAnalyzer
Paid APISelf-hosted - 18
Trellix Intelligent Sandbox
Paid APISelf-hostedWeb - 19
VirusTotal Intelligence
Paid APIWeb - 20
AhnLab MDS
Paid LinuxWindows - 21
Bitdefender Sandbox Service
Paid Web - 22
Cisco Meraki Dashboard
Paid Web - 23
CrowdStrike Falcon Sandbox
Paid Web - 24
MetaDefender Aether
Paid Web - 25
Palo Alto Networks WildFire
Paid Web
Alternatives suit different investigation workflows, input types, deployment needs, or security goals. Retrace’s public analyses expose results and behavioral data to other service users, and prices for its paid tiers are not provided. Before switching, weigh whether you need real-time interaction, automated static and dynamic analysis, custom hosting, specific report formats, or protection for everyday devices. Check supported platforms, privacy controls, and integrations against the work you need to do.