The analyst-grade malware sandbox · in beta

Watch malware run. Read its traffic. Pull its config.

Most sandboxes give you a verdict. malbox gives you the proof. Zero agents in the guest. Decrypted HTTPS. Live interactive Windows VMs. Every byte we see, you see too — process events, pcap, memory dumps, extracted C2 config, YARA + Suricata hits — in about two minutes.

Try it →   Read the docs   Contact sales

Everything you need to understand what a Windows malware sample does

malbox is an online malware sandbox for Windows 10 and Windows 11 samples. Drop a Windows PE, a URL, or a password-protected archive (zip, 7z, rar — the archive password infected is tried automatically). A fresh virtual machine boots, runs the sample for 30 seconds to 30 minutes, and you get back one unified report.

• Dynamic analysis in a Windows VM. Every process start and exit, image load, thread injection, file write, registry mutation, DNS query, HTTP request, and TCP flow — timestamped, joined on the sample's SHA-256.
• Decrypted HTTPS by default. A per-job MITM TLS proxy with a baked-in CA sits between the guest and the internet. Request and response bodies land in plaintext — read the C2 handshake, not the ciphertext.
• Extracted C2 config for 40+ RAT and stealer families. A Rust registry plus MACO community parsers cover NanoCore, AsyncRAT, Remcos, DCRat, Lumma, RedLine, Formbook, AgentTesla, QuasarRAT, Stealc, and more — pulled from memory and disk with their raw dump.
• Suricata NIDS over the pcap. The full ET Open ruleset runs post-collection. Signatures badge on the destination row and you can hex-view the TCP-reassembled bytes of any flow.
• YARA-X scanning of every artifact. Sample, dropped files, process dumps, memory dumps — all scanned as they land in object storage.
• Third-party threat intelligence joined per sample. VirusTotal, Triage, Hybrid Analysis, MalwareBazaar, YARAify, and MalShare lookups on the one SHA-256.
• MITRE ATT&CK-mapped behavior tags. Each tag carries the technique IDs — execution.dropped-then-exec maps to T1204, injection.remote-thread to T1055, and so on.
• Live interactive VNC. Open the Screen panel on any running job, click gate control, and interact with the sample as a victim would.

From a file on your desktop to a full malware report in two minutes

1. Drop a sample. Drag a Windows PE, paste a URL, or upload a password-protected archive. Already-seen SHA-256s skip the upload entirely.
2. Boot and run. Fresh Windows VM, agent on the host (not in the guest), 90-second observation window by default. Live VNC available.
3. Read the report. Behavior tags with MITRE mappings, extracted config, Suricata alerts, decrypted HTTP bodies, screenshots, replay, pcap.

Open telemetry you can trust

Built on Suricata, YARA-X, the ET Open ruleset, MITRE ATT&CK, Volatility, MACO, libvirt, MinIO, and Kafka. All signals are open and inspectable; nothing is proprietary black-box scoring.

Submit a sample · Recent analyses · Docs · Pricing · Status · Changelog · Security · Privacy · Terms · Contact