cert-polska/drakvuf-sandboxAutomated hypervisor-level malware analysis sandbox with agentless guest introspection, web-based result exploration, and guided installer for production deployment.
[!WARNING]
Here be dragons 🐉. Maintaining your own sandbox is a difficult task and this project uses technology that is not user-friendly. Be prepared to brush up on your debugging skills as bugs may be reproducible only on your configuration. On the other hand, it's not purely an R&D project and it is used in production! Source code and issues section on both DRAKVUF Sandbox and DRAKVUF engine projects are your best friend.
DRAKVUF Sandbox is an automated black-box malware analysis system with DRAKVUF engine under the hood, which does not require an agent on guest OS.
This project provides you with a friendly web interface that allows you to upload suspicious files to be analyzed. Once the sandboxing job is finished, you can explore the analysis result through the mentioned interface and get an insight on whether the file is truly malicious or not.
Because it is usually pretty hard to set up a malware sandbox, this project also provides you with an installer app that would guide you through the necessary steps and configure your system using settings that are recommended for beginners. At the same time, experienced users can tweak some settings or even replace some infrastructure parts to better suit their needs.
In order to run DRAKVUF Sandbox, your setup should fulfill all the listed requirements.
Nested virtualization:
Feel free to contact us if you have any questions or comments.
General contact email: [email protected] (fastest response)
You can also chat with us about this project on Discord: https://discord.gg/Q7eTsHnpn4
This project is authored by:
If you have any questions about DRAKVUF engine itself, contact [email protected]
This project was created and/or upgraded thanks to the following organizations and initiatives:
