CERT-Polska/drakvuf-sandbox

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1334 stars · 160 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

DRAKVUF Sandbox is an automated, agentless malware analysis system that runs suspicious files inside a hypervisor-level sandbox powered by the DRAKVUF engine. It ships with a web interface for uploading samples and exploring analysis results, plus an installer to simplify setup.

Use cases

• analyze suspicious files for malware
• set up a self-hosted malware sandbox
• automate malware triage without a guest agent
• inspect behavior of Windows malware samples
• run hypervisor-level malware research

When to choose

• you need automated, agentless black-box malware analysis on bare-metal or nested virtualization with Intel VT-x/EPT
• you want a web UI to submit samples and review reports
• you are a malware researcher or CERT team running your own sandbox

When to avoid

• you want a simple turnkey sandbox on cloud VMs (AWS/GCP/Azure unsupported)
• your host lacks Intel VT-x with EPT or uses Hyper-V
• you need a low-maintenance setup - the project warns that running your own sandbox is difficult and debugging-heavy

Facets

application · maturity active

security reverse-engineering gui http-server developer-tools security reverse-engineering self-hosted developer-tools self-hosted python malware-analysis sandbox drakvuf xen hypervisor automated-analysis cert-polska linux web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="CERT-Polska/drakvuf-sandbox")