Retrace

Retrace is an AI-powered malware analysis platform that runs samples in interactive virtual machines for Windows, macOS, Linux, and Android. Each virtual machine is disposable and separate from the user's laptop. During analysis, Retrace captures file writes, registry activity, network packets, and process spawns. Its AI copilot answers questions using the resulting trace and points to particular events, techniques, or captured files. Each detonation is also matched against the user's sandbox corpus to show similarity and malware-family evidence. AI answers can be exported as Markdown, PDF, or STIX 2.1 bundles for MISP or other threat-intelligence platforms. The free Community plan includes public analyses, standard execution queue access, a web interface, and basic report export. Results from public analyses—including events, behavioral data, screenshots, and detections—are visible to all service users. Team includes private submissions, priority queueing, REST API access, team management, and audit logging. Enterprise offers dedicated hardware, optional UK, EU, or US data residency, SSO/SAML, and custom retention; its inference runs on-premises. Sovereign deployments are air-gapped and keep sample bytes, IOCs, and tool calls within customer infrastructure.

Retrace combines multi-OS sandbox analysis with trace-based AI answers and corpus matching. Public submissions are visible to other service users, while private submissions and deployment controls are available on higher tiers.

Retrace is intended for legitimate security researchers, malware analysts, incident responders, and threat-intelligence teams. Its deployment options may suit teams with specific infrastructure or data-residency requirements.

Retrace is a malware-analysis platform for security researchers, incident responders, and threat-intelligence teams. It is strongest for analysts who need to connect multi-OS execution traces with corpus-based similarity evidence and cited AI answers; sensitive work calls for a paid tier.

Overview

Samples run in disposable virtual machines, separate from the analyst’s laptop. Retrace records file writes, registry activity, network packets, and process launches, giving investigators several kinds of observed behavior to examine. Its copilot answers questions against those traces and cites events, techniques, or captured files, a useful way to follow an AI-generated explanation back to evidence.

Each detonation is also matched against the user’s full sandbox corpus for similarity and malware-family evidence. Analysts can export AI answers as Markdown, PDF, or STIX 2.1 bundles for MISP and other threat-intelligence platforms. That combination supports investigation and reporting, but the cited evidence still needs analyst interpretation.

Key features

• Interactive multi-OS execution: Windows, macOS, Linux, and Android virtual machines let researchers inspect behavior across those environments without executing samples on their own laptop.
• Trace-based investigation: File, registry, network, and process telemetry gives the copilot concrete activity to cite. This is more useful for follow-up than an answer detached from observed events.
• Corpus matching: Every detonation is compared with the user’s full sandbox corpus, adding similarity and family evidence to a single analysis.
• Analysis exports: Markdown, PDF, and STIX 2.1 exports suit both readable reports and threat-intelligence workflows.
• Deployment controls: Enterprise inference runs on-premises; Sovereign deployments are air-gapped and keep sample bytes, IOCs, and tool calls within the customer’s infrastructure. These options address strict data-control needs, but require a higher-tier deployment.

Pricing

Retrace uses a freemium model. Community costs nothing and includes Community feed access, a standard execution queue, the web interface, basic report export, and unlimited public analyses. It is a practical entry point for non-sensitive work, but public results are visible to all service users and the standard queue is not the priority option.

Team has custom pricing and adds private submissions, priority queueing, REST API access, team management, and audit logging. It is the more appropriate fit when submissions must remain private or a team needs shared controls and API access.

Enterprise has custom pricing and includes a multi-tenant workspace, dedicated hardware, SSO/SAML, custom data retention, and UK, EU, or US data residency on request. On-premises inference further suits organizations with deployment requirements that Community and Team do not address.

Sovereign has custom pricing and offers air-gap compatibility, unlimited throughput, full data sovereignty, custom hardware support, and a dedicated account manager. It targets customers with the strictest infrastructure and throughput requirements, rather than teams seeking a low-cost starting point.

Public analyses expose results, events, behavioral data, screenshots, and detection results to all service users. API keys must remain confidential, documented rate limits apply, and automated bulk submissions must follow fair-use guidelines. Support depends on plan tier.

Platforms

Retrace supports Android, API, Linux, macOS, self-hosted, web, and Windows. Its sandbox environments cover Windows, macOS, Linux, and Android. The broader platform availability gives teams several ways to access or deploy the service, while the analysis environments center on those four operating systems.

Who it's for

Retrace is designed for legitimate security research, malware analysis, incident response, and threat intelligence. Community suits users who can make analyses public and tolerate a standard queue. Teams handling sensitive samples should consider Team or above; organizations requiring on-premises inference, dedicated hardware, or air-gapped operation have Enterprise and Sovereign options.

It is not the right choice for confidential investigations on Community, nor for buyers seeking a general-purpose endpoint security product: Retrace is focused on sandbox analysis and its associated evidence and reporting.

Pros and cons

• Pro: Disposable virtual machines isolate execution from the user’s laptop, while four supported sandbox operating systems broaden the range of samples analysts can examine.
• Pro: Trace citations and corpus matching give analysts both observed behavior and similarity evidence to investigate.
• Pro: STIX 2.1 export and higher-tier API access support threat-intelligence workflows.
• Con: Community analyses are public, including behavioral data, screenshots, and detection results, ruling out that tier for sensitive samples.
• Con: Private submissions and priority queueing begin with Team, whose price is custom rather than a published amount.
• Con: API usage is subject to documented rate limits and fair-use rules for automated bulk submissions.

Alternatives

Malware Analysis Sandboxes is the broader category to browse if you want to compare sandbox tools beyond Retrace.

• ANY.RUN is another freemium option with a free plan and support for Android, API, iOS, Linux, macOS, web, and Windows; consider it if iOS support matters.
• Bitdefender Total Security is a paid security product with a free plan and trial, priced at $59.99 a year for the first year for five devices and one account; choose it if you need protection across personal devices rather than a malware-analysis sandbox.
• SorbSecurity Cloud Sandbox is a paid alternative spanning Android, API, self-hosted, web, and Windows.
• Hatching Triage is a freemium alternative with Android, API, Linux, macOS, self-hosted, web, and Windows support; its volume-based license starts at 500 analyses per day and scales toward 50,000 per day, making it worth considering when throughput is a central requirement.
• ReversingLabs Cloud Sandbox offers a free feature preview capped at five samples per day, with full access available at additional cost; consider it if a limited preview is enough to evaluate a sandbox.
• Zscaler Private Access is a paid private-access product rather than a malware-analysis sandbox.
• CrowdStrike Falcon Pro is a paid endpoint-security option with a free trial, priced at $14.99 a month per device, billed monthly; consider it for Windows and macOS firewall policies and detection details retained up to 90 days.
• Kaspersky Research Sandbox is a paid alternative supporting cloud or on-premise deployment and air-gapped environments.

Verdict

Retrace is a strong fit for security teams that want multi-OS sandbox traces, corpus matching, and AI answers tied to specific evidence in one workflow. The main reason to choose it is that investigation and exportable reporting share the same trace and corpus context. The main reason to look elsewhere is the tier boundary: Community exposes analyses publicly, while private submissions and stronger deployment controls require custom-priced plans.