kevoreilly/CAPEv2

Health v2 · maintenance only

Flags: no_releases no_license

Adoption not part of the score

3451 stars · 597 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

CAPEv2 is a malware sandbox derived from Cuckoo that executes malicious files in isolated environments while instrumenting their behavior and collecting forensic artifacts. It adds automated unpacking, YARA-based payload classification, and static/dynamic malware configuration extraction on top of traditional sandbox capabilities.

Use cases

• detonate malware samples in an isolated sandbox
• extract malware configurations automatically
• unpack packed malware payloads dynamically
• capture network traffic and memory dumps from malware execution
• classify malware using YARA signatures
• analyze malware behavior with API hooking and debugging

When to choose

• you need automated malware config and payload extraction
• you want a maintained Cuckoo Sandbox successor
• you need YARA-driven unpacking and debugger control of malware
• you run a self-hosted malware analysis lab

When to avoid

• you need static-only analysis without execution
• you cannot dedicate Windows VMs and isolation infrastructure
• you need a simple file scanner rather than dynamic detonation

Facets

application · maturity active

security reverse-engineering monitoring security reverse-engineering windows python self-hosted malware-sandbox cuckoo-fork yara config-extraction unpacking threat-intelligence sandbox malware-analysis linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="kevoreilly/CAPEv2")