- Home
- Sandbox Software
- CAPE Sandbox
CAPE Sandbox
What it is
CAPE Sandbox is an open-source malware analysis system that executes malicious files in an isolated environment and records behavior and forensic artifacts. Its outputs include API-hook activity, file changes, PCAP network captures, desktop screenshots, and full memory dumps. It can dynamically unpack malware and extract configurations through static and dynamic analysis. Classification can use YARA scans of unpacked payloads, Suricata scans of network captures, and behavioral signatures derived from API-hook output. A programmable debugger supports custom unpacking and configuration extractors, anti-sandbox countermeasures, and instruction traces. Configuration parsing supports CAPE's framework and integrations including RATDecoders, DC3-MWCP, MalDuck, and MaCo. Documentation covers a REST API, distributed setup, and endpoints for tasks, reports, files, PCAPs, and machines. The project recommends Ubuntu 24.04 LTS for installation, Windows 10 or Windows 11 23H2 as the target, and KVM as the hypervisor. Active unpacking is disabled by default because it may affect detonation quality. CAPE is free and self-hosted, with an online demonstration instance.
For and against
For
- Captures API behavior, file changes, PCAPs, screenshots, and memory dumps.
- Supports dynamic unpacking and configuration extraction.
- Provides REST API and distributed setup documentation.
- Free, open-source project with an online demonstration instance.
Against
- Active unpacking is off by default.
- Installation recommendations specify Ubuntu 24.04 LTS and KVM.
- Published security policy lists some versions as unsupported.
The verdict
CAPE brings behavioral capture, unpacking, classification, and configuration parsing into a self-hosted analysis system. Its recommended deployment setup and inactive-by-default active unpacking are important considerations.
Who it suits
CAPE Sandbox is suited to malware analysts and researchers who need to examine behavior, extract configurations, and work with forensic artifacts. Its self-hosted deployment and programmable debugger support customized analysis workflows.
Plans and prices
CAPE Sandbox
Open-source project; self-hosted installation; free online demonstration instance
Read 7 Oct 2026 · github.com
On the record
- Analysis output
- Its core capabilities include API-hook behavioral instrumentation, file-change capture, PCAP network capture, malware classification, desktop screenshots, and full memory dumps.github.com · read 7 Oct 2026
- API and distributed use
- The documentation includes a REST API, distributed CAPE setup, and API endpoints for tasks, reports, files, PCAPs, and machines.capev2.readthedocs.io · read 7 Oct 2026
- Classification
- Malware classification can use YARA scans of unpacked payloads, Suricata scans of network captures, and behavioral signatures over API-hook output.github.com · read 7 Oct 2026
- Debugger
- A debugger programmable through YARA signatures supports custom unpacking and config extractors, anti-sandbox countermeasures, and instruction traces.github.com · read 7 Oct 2026
- Deployment requirements
- The project recommends Ubuntu 24.04 LTS for installation, Windows 10 or Windows 11 23H2 as the target, and KVM as the hypervisor.github.com · read 7 Oct 2026
- Intended users
- The project invites contributions of signatures, parsers, and bypasses for additional malware families, indicating a community of malware analysts and researchers.github.com · read 7 Oct 2026
- Other integrations
- The documentation lists integrations for Box-js, Curtain, LibreNMS, and Suricata.capev2.readthedocs.io · read 7 Oct 2026
- Parser integrations
- Configuration parsing supports CAPE's framework as well as RATDecoders, DC3-MWCP, MalDuck, and MaCo.github.com · read 7 Oct 2026
- Purpose
- CAPE is a malware sandbox that executes malicious files in an isolated environment while recording behavior and collecting forensic artifacts.github.com · read 7 Oct 2026
- Security reporting
- The repository security policy directs vulnerability reports to [email protected] or the CAPE Sandbox Twitter account.github.com · read 7 Oct 2026
- Supported versions
- The published security policy marks versions 5.1.x and 4.0.x as supported and 5.0.x and versions below 4.0 as unsupported.github.com · read 7 Oct 2026
- Unpacking and extraction
- CAPE adds automated dynamic malware unpacking and static and dynamic malware configuration extraction.github.com · read 7 Oct 2026
- Unpacking limitation
- Active unpacking is off by default because it may affect detonation quality.github.com · read 7 Oct 2026
