Sandboxes

This page mixes practical malware detonation options with the underlying isolation technologies that make safer code execution possible.

Sandbox-as-a-Service

Multi-engine

VirusTotal

Fast triage for suspicious files, hashes, URLs, and domains with broad community context.

virustotal.comBehavioral

Hybrid Analysis

Cloud detonation with behavioral reporting that is useful when you want a quick second opinion.

hybrid-analysis.comDeep reports

Joe Sandbox

Detailed dynamic analysis and rich reporting for malware samples and suspicious artifacts.

joesandbox.comInteractive

ANY.RUN

Interactive sandboxing that is especially handy when you want to step through activity manually.

any.runTriage-first

Hatching Triage

Sample analysis with approachable reporting and strong visual summaries for quick investigation.

tria.ge

Browser Isolation

For manual browsing and investigation without spinning up your own virtual machines:

Safe browsing

Browserling

Disposable remote browser sessions for loading sketchy sites without touching your local environment.

browserling.com

URL and Web Detonation

For suspicious links when you want screenshots, requests, and lightweight behavioral context:

Web scans

urlscan.io

Excellent for screenshots, request chains, domains contacted, and other fast-turn URL investigation details.

urlscan.ioBehavioral URL analysis

urlquery

Useful when you want another detonation-style view of redirects, requests, and visible page behavior.

urlquery.netStatic plus emulation

Filescan

Helpful for quick analysis of suspicious documents and scripts when you want emulation without a full local lab.

filescan.io

Pipeline-Friendly

For local file analysis in a pipeline using open-source tooling:

Self-hosted

Cuckoo Sandbox

Classic open-source sandboxing for teams that want local analysis workflows and deeper customization.

github.com/cuckoosandboxSelf-hosted

CAPEv2

Great for local detonation workflows when you want stronger unpacking, config extraction, and continued Cuckoo-style flexibility.

github.com/kevoreilly/CAPEv2Agentless

DRAKVUF

Powerful for deeper malware analysis workflows when you want virtual-machine introspection rather than in-guest agents.

github.com/tklengyel/drakvufSample management

Viper

A malware sample management and binary-analysis framework for organizing collections, scripts, and repeatable research workflows.

github.com/viper-framework/viperAnalysis platform

IRMA

Great when you want an asynchronous, self-hostable analysis platform that can orchestrate multiple scanners and sandbox backends.

irma.readthedocs.io

Linux, Firmware, and Specialized Analysis

Linux malware

detux

Useful for traffic-oriented analysis of Linux malware and quick IOC capture in ELF-heavy cases.

github.com/detuxsandbox/detuxLinux sandbox

Limon

A Linux-focused sandbox that is still handy when you want a more specialized environment for ELF detonation and observation.

github.com/monnappa22/Limon

Isolation Technologies

MicroVMs

Firecracker

A strong building block for high-isolation ephemeral execution when you want VM boundaries without traditional VM overhead.

github.com/firecracker-microvm/firecrackerApplication kernel

gVisor

Useful when you want a stronger boundary than plain containers while keeping a more container-native operational model.

gvisor.devProcess isolation

nsjail

A practical option for constrained local code execution and sandboxing on Linux when you want something lighter than a VM.

github.com/google/nsjailSecure containers

Kata Containers

Combines container ergonomics with VM-style isolation, which makes it a useful middle ground for untrusted workloads.

katacontainers.ioRuntime isolation

WebAssembly

Useful when your sandboxed execution model is language- or plugin-oriented and you want a very lightweight runtime boundary.

webassembly.org

Analysis Workstations and Lab Helpers

Linux analysis distro

REMnux

A go-to Linux toolkit for malware analysis labs when you want a purpose-built workstation packed with reverse-engineering and detonation helpers.

docs.remnux.orgWindows analysis VM

FLARE VM

Excellent for building a Windows-based reverse-engineering and malware-analysis workstation without curating every tool by hand.

github.com/mandiant/flare-vmNetwork simulation

FakeNet-NG

Very handy in a malware lab when you want samples to believe they have network connectivity while you safely observe the traffic.

github.com/mandiant/flare-fakenet-ng

Shoutout to large maintained resources like awesome-sandbox, awesome-malware-analysis, Malware-Analysis, and malware-tools, which helped me cross-check both the malware-analysis side and the broader isolation/runtime side of this page.