Best Malware Analysis Sandboxes in 2026
Updated
In short: ANY.RUN is ranked #1 of 19 as of 4 October 2026, ahead of ReversingLabs Cloud Sandbox and Retrace. The best-ranked option with a free plan is Retrace. The lowest first paid tier on this page is Malwagon at $79/mo.
When you need to examine suspicious files or URLs, a malware analysis sandbox can be compared across its stated investigation capabilities and access details. Look at URL analysis, network traffic analysis, and IOC extraction, along with the deployment model and file size limit. API access and result retention offer additional criteria to consider. Free-plan availability and paid-from pricing can help put access and cost in context. ANY.RUN, ReversingLabs Cloud Sandbox, and Retrace are among the entries, alongside Hatching Triage and CAPE Sandbox. Use the listed capabilities to judge which options align with the samples and analysis needs you handle.
19 malware analysis sandboxes ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
Recognised 40% · Phone app 26% · Documented 20% · Free plan 14% of the score
- 1 ANY.RUN iPhone + Android RecognisedPhone appDocumentedFree plan 9.8Free URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 2 ReversingLabs Cloud Sandbox Android only RecognisedPhone appDocumentedFree plan 8.9 URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 3 Retrace Android only RecognisedPhone appDocumentedFree plan 8.8Free URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 4 Hatching Triage Android only RecognisedPhone appDocumentedFree plan 8.5 URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 5 CAPE Sandbox No phone app RecognisedPhone appDocumentedFree plan 8.1Free URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 6 Kaspersky Research Sandbox Android only RecognisedPhone appDocumentedFree plan 7.7 URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 7 Hybrid Analysis No phone app RecognisedPhone appDocumentedFree plan 7.5Free URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 8 Malwagon No phone app RecognisedPhone appDocumentedFree plan 7.4$79/mo URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 9 SorbSecurity Cloud Sandbox Android only RecognisedPhone appDocumentedFree plan 7.4 URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 10 Trellix Intelligent Sandbox No phone app RecognisedPhone appDocumentedFree plan 6.9 URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 11 CrowdStrike Falcon Sandbox No phone app RecognisedPhone appDocumentedFree plan 6.5 URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 12 FortiSandbox No phone app RecognisedPhone appDocumentedFree plan 6.4 API access: Yes
- 13 ThreatAnalyzer No phone app RecognisedPhone appDocumentedFree plan 5.7 URL analysis: YesAPI access: YesNetwork traffic analysis: Yes
- 14 DRAKVUF Sandbox No phone app RecognisedPhone appDocumentedFree plan 5.6 URL analysis: NoAPI access: YesNetwork traffic analysis: Yes
- 15 Detonate No phone app RecognisedPhone appDocumentedFree plan 5.3 URL analysis: NoAPI access: YesNetwork traffic analysis: Yes
- 16 Cisco Catalyst Center No phone app RecognisedPhone appDocumentedFree plan 5.3 API access: Yes
- 17 ThreatLab No phone app RecognisedPhone appDocumentedFree plan 5.2 URL analysis: YesNetwork traffic analysis: Yes
- 18 VirusTotal Intelligence No phone app RecognisedPhone appDocumentedFree plan 4.8 API access: Yes
- 19 Symantec IT Management Suite No phone app RecognisedPhone appDocumentedFree plan 4.6
Compare all 19 in a table
| # | App | Score | Free plan | From | Free plan | Paid from | URL analysis | API access |
|---|---|---|---|---|---|---|---|---|
| 1 | ANY.RUN | 9.8 | Free plan | Free | Yes | — | Yes | Yes |
| 2 | ReversingLabs Cloud Sandbox | 8.9 | No | — | — | — | Yes | Yes |
| 3 | Retrace | 8.8 | Free plan | Free | Yes | — | Yes | Yes |
| 4 | Hatching Triage | 8.5 | No | — | Yes | — | Yes | Yes |
| 5 | CAPE Sandbox | 8.1 | Free plan | Free | — | — | Yes | Yes |
| 6 | Kaspersky Research Sandbox | 7.7 | No | — | No | — | Yes | Yes |
| 7 | Hybrid Analysis | 7.5 | Free plan | Free | Yes | — | Yes | Yes |
| 8 | Malwagon | 7.4 | Free plan | $79/mo | Yes | 79 /mo | Yes | Yes |
| 9 | SorbSecurity Cloud Sandbox | 7.4 | No | — | — | — | Yes | Yes |
| 10 | Trellix Intelligent Sandbox | 6.9 | No | — | — | — | Yes | Yes |
| 11 | CrowdStrike Falcon Sandbox | 6.5 | No | — | No | — | Yes | Yes |
| 12 | FortiSandbox | 6.4 | No | — | — | — | — | Yes |
| 13 | ThreatAnalyzer | 5.7 | No | — | — | — | Yes | Yes |
| 14 | DRAKVUF Sandbox | 5.6 | No | — | — | — | No | Yes |
| 15 | Detonate | 5.3 | No | — | Yes | — | No | Yes |
| 16 | Cisco Catalyst Center | 5.3 | No | — | — | — | — | Yes |
| 17 | ThreatLab | 5.2 | No | — | No | — | Yes | — |
| 18 | VirusTotal Intelligence | 4.8 | No | — | — | — | — | Yes |
| 19 | Symantec IT Management Suite | 4.6 | No | — | — | — | — | — |
Is your app on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which malware analysis sandboxe is ranked first on Samsung Mobile US Press?
ANY.RUN is ranked #1 of 19 with a score of 9.8. ReversingLabs Cloud Sandbox is second and Retrace third.
How many of these have a free plan?
5 of the 19 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Malwagon has the lowest first paid tier we found: $79/mo.
How is this list ranked?
Ranked mobile-first: a phone app alongside the web or desktop product, a free tier and the depth of its documentation. Paid placements never change a rank.