Submit a suspicious email attachment to automatically find out if it contains malware before opening it on a real system.
Analyze ransomware or malware samples in an isolated VM to see exactly what system changes they attempt.
Automate malware triage for security incident response, processing batches of suspicious files in a queue.
Generate detailed behavioral reports showing a file's network connections, file system changes, and registry modifications.
| cuckoosandbox/cuckoo | jakiestfu/snap.js | kbrsh/moon | |
|---|---|---|---|
| Stars | 5,955 | 5,957 | 5,959 |
| Language | JavaScript | JavaScript | JavaScript |
| Setup difficulty | hard | easy | easy |
| Complexity | 4/5 | 2/5 | 2/5 |
| Audience | ops devops | developer | developer |
Figures from each repo's GitHub metadata at analysis time.
Requires a hypervisor such as VirtualBox or KVM for isolated guest VMs, this version (2.x) is unmaintained and should not be used in production.
Cuckoo Sandbox is an open source tool that automatically analyzes suspicious files to determine whether they are malware. You give it a file you are unsure about, and within seconds it runs that file inside a safe, isolated environment and reports back exactly what happened: what the file tried to do, what system changes it made, and how it behaved overall. The "sandbox" part of the name refers to that isolated container, which keeps whatever the file does from affecting the rest of your real machine. The analysis is fully automated, so there is no need to set up manual testing steps. You submit a file, Cuckoo executes it, and the results describe the file's behavior in detail. This makes the tool useful for security researchers, IT teams responding to incidents, or anyone who needs to check whether a file is safe before opening it on a real system. The project was once considered the leading open source tool of its kind. The version stored in this repository (2.x) is currently not being maintained. The development team is working on a full rewrite of Cuckoo that has not yet been released, and open issues or pull requests on this version are unlikely to be addressed in the meantime. For those who still want to use the last stable build, it can be installed via a standard Python package manager command. Setup instructions and community discussion links are available on the Cuckoo website and in the documentation linked from the README. The team explicitly recommends against using this development branch in production. If you are looking at this repository hoping to use Cuckoo today, the short version is: the project works for what it was designed to do, but this version is on hold while the team rebuilds it from scratch.
Cuckoo Sandbox is an open source automated malware analysis tool, submit a suspicious file and it runs it inside an isolated environment, then reports exactly what the file tried to do. Note: this version (2.x) is unmaintained while a full rewrite is in progress.
Mainly JavaScript. The stack also includes Python, JavaScript, VirtualBox.
Setup difficulty is rated hard, with roughly 1h+ to a first successful run.
Mainly ops devops.
This repo across BitVibe Labs
Verify against the repo before relying on details.