- Home
- Malware Analysis Sandboxes
- Malwagon
Malwagon
What it is
Malwagon is a malware-analysis sandbox that examines files, URLs, commands, documents, packages and Windows kernel drivers in isolated virtual machines. It returns scored verdicts with evidence for incident responders, detection engineers, SOC analysts and threat researchers. Static analysis can identify capabilities, recover obfuscated strings, check packers and entropy, scan signatures and secrets, disassemble files, extract configurations and run YARA. Dynamic analysis records ETW kernel telemetry, memory-forensics data, hypervisor introspection and network traffic, including JA3/JA4 fingerprints. Reports can include MITRE ATT&CK mappings and generated YARA, Sigma and Suricata rules, with exports such as ATT&CK Navigator, STIX 2.1, MISP, defanged IOC lists, PDF and DOCX. Accepted submissions include executables and archives up to 128 MB, URLs, shell commands, office and PDF documents, Windows drivers, pip packages and hashes. Each analysis uses a dedicated virtual machine that is discarded after the run. Free-tier reports are public; paid plans can make scans private. Paid plans start at $79 a month.
For and against
For
- Analyzes files, URLs, commands and packages
- Runs each analysis in an isolated virtual machine
- Reports can include ATT&CK mappings and detection rules
- Provides REST API, MCP server and Python CLI
Against
- Executables and archives are limited to 128 MB
- Free-tier reports are public
- Paid plans start at $79 a month
The verdict
Malwagon combines isolated analysis with scored results, telemetry and report exports for security teams. Readers should note that free-tier reports are public and paid plans start at $79 a month.
Who it suits
Malwagon is designed for incident responders, detection engineers, SOC analysts and threat researchers. Unauthenticated users can also submit untrusted attachments and read reports.
Plans and prices
Community
20 scan credits/month · 120-second runs · Windows 10 and Ubuntu 24.04 · 1 concurrent scan
Read 15 Oct 2026 · malwagon.com
Free scan
3 scans per source address per day · Windows 10 22H2 · network isolated · public report
Read 15 Oct 2026 · malwagon.com
Pro
200 credits/month · 300-second runs · 7 sandboxes · 3 concurrent scans
Read 15 Oct 2026 · malwagon.com
Business
500 credits/month · 600-second runs · 7 sandboxes · 5 concurrent scans
Read 15 Oct 2026 · malwagon.com
Team / Enterprise
5,000 credits/month · 600-second runs · 7 sandboxes · 10 concurrent scans
Read 15 Oct 2026 · malwagon.com
On the record
- Account security
- The service documents 12-character minimum passwords, TOTP two-factor authentication, sign-in rate limiting and revocable API tokens.malwagon.com · read 15 Oct 2026
- AI data boundary
- The AI narrative receives locally derived summaries, API-call sequences, indicators and extracted strings rather than sample bytes.malwagon.com · read 15 Oct 2026
- Analysis layers
- Static analysis includes YARA, capability identification, obfuscated-string recovery, packer and entropy checks, signature scanning, disassembly, secrets scanning and configuration extraction.malwagon.com · read 30 Sep 2026
- API upload limit
- The API has a file-upload route, but the documentation says the MCP server cannot upload bytes and other API submissions name targets as text.malwagon.com · read 15 Oct 2026
- CLI
- The Python CLI installs with pip, has no dependencies, runs on Linux, macOS and Windows, and returns exit codes for clean, malicious, suspicious and error results.pypi.org · read 15 Oct 2026
- CLI licence
- The PyPI package identifies itself as MIT licensed and OSI-approved.pypi.org · read 15 Oct 2026
- CLI maintainer
- PyPI lists one maintainer, zecrain, and credits Malwagon as the author.pypi.org · read 15 Oct 2026
- CLI platforms
- The Malwagon CLI has no dependencies and runs on Linux, macOS and Windows.malwagon.com · read 30 Sep 2026
- CLI release
- PyPI lists version 0.1.3 uploaded on September 7, 2026, with a 0.1.2 release also dated September 7, 2026.pypi.org · read 15 Oct 2026
- CLI runtime
- The PyPI package requires Python 3.8 or newer and is classified for Windows, macOS, Linux/POSIX and Python 3.pypi.org · read 15 Oct 2026
- Command analysis
- Command analysis executes PowerShell, CMD and bash text after local decoding of common obfuscation forms.malwagon.com · read 15 Oct 2026
- Company founding
- No founding year is stated on the reviewed official pages or the PyPI project page.malwagon.com · read 15 Oct 2026
- Company headquarters
- No headquarters location is stated on the reviewed official pages or the PyPI project page.malwagon.com · read 15 Oct 2026
- Data handling
- Malwagon says submitted samples stay on its infrastructure; external reputation services receive only hashes and derived indicators.malwagon.com · read 15 Oct 2026
- Detection outputs
- Reports can export ATT&CK Navigator, STIX 2.1, MISP, defanged IOC, PDF and DOCX formats, plus generated YARA, Sigma and Suricata rules.malwagon.com · read 15 Oct 2026
- Document analysis
- Document analysis opens Office, PDF, RTF, OneNote, CHM and web-container formats in the application that owns the format.malwagon.com · read 15 Oct 2026
- Documentation depth
- The documentation covers submission modules, analysis options, report interpretation, exports, visibility, retention, REST endpoints, MCP methods, errors and rate limits.malwagon.com · read 15 Oct 2026
- Dynamic analysis
- Dynamic analysis records ETW kernel telemetry, memory forensics, hypervisor introspection, network capture and JA3/JA4 fingerprints.malwagon.com · read 30 Sep 2026
