CAPEv2

CAPE is a malware sandbox: you feed it a suspicious file, it runs that file inside an isolated Windows virtual machine, and it reports everything the file did. Files touched, network traffic, memory dumps, screenshots. What sets it apart from its Cuckoo roots is automatic unpacking and extraction of the malware's hidden config, like the command-and-control addresses analysts actually want. It's the free, self-hosted answer to ANY.RUN, Joe Sandbox and VMRay.

Setup is the opposite of docker run. The docs push an Ubuntu 24.04 host running KVM, built by two install scripts over 3,000 lines combined, and want you to swap hardware ID placeholders first so malware can't tell it's in a VM. Then you build Windows 10 or 11 guests with 32-bit Python. There are no releases: you git pull a rolling branch.

Nothing is paywalled. Solo analysts: free, try the public demo at capesandbox.com first. Small and larger teams: free, but someone has to own that box.

The catch: you are running live malware on purpose. A guest that can reach your LAN is an incident, not a bug report. The docs also warn that updating packages with apt can break the whole install.