DRAKVUF Sandbox: Agentless Malware Analysis Right in Your Browser
If you've ever tried to reverse engineer a Windows malware sample in a sandbox, you know the pain. Most solutions either require an agent inside the VM (which malware can detect and evade) or they're expensive, closed-source platforms. That's why DRAKVUF Sandbox caught my eye.
It's an open source, agentless malware analysis system for Windows that gives you a web UI to inspect behavior. No agents. No installations inside the guest. Just raw introspection from the hypervisor layer.
Let's break down what makes this interesting.
What It Does
DRAKVUF Sandbox runs Windows virtual machines under KVM (using QEMU) and uses hardware virtualization extensions (Intel VT-x) to monitor everything happening inside the guest OS — without the guest knowing it's being watched.
When you submit a sample, the system:
- Launches a fresh Windows VM
- Executes the sample
- Records all system calls, process activity, file operations, registry changes, network connections, and memory modifications
- Presents the results in a clean web UI
The key word here is agentless. There's no driver, no DLL, no userland code running inside Windows. DRAKVUF does its magic entirely from outside the VM, using the Xen hypervisor (or KVM with patches) to introspect the guest's memory and CPU state.
Why It's Cool
No evasion surface. Since nothing runs inside Windows, malware can't detect or disable the analysis tool. No agents to uninstall, no hooks to detect. This is huge for analyzing packed or anti-analysis samples.
Kernel-level visibility. You see system calls, interrupts, and kernel operations that userland tools miss. DRAKVUF can trace SSDT (System Service Descriptor Table) calls, which gives you a clear picture of what the malware is doing at the kernel level.
Replayable snapshots. The system can revert the VM to a clean state automatically, so you can chain multiple samples without manual cleanup.
Web UI that doesn't suck. You get a React-based frontend with graphs of process trees, registry changes, file writes, and network connections. Everything is clickable and exportable as JSON.
It's from CERT Polska. That's a real security team building real tools, not a side project someone abandoned. The repo is actively maintained (last commit in 2025).
How to Try It
This isn't a one-liner install — it's a full infrastructure setup. But the docs are straightforward:
- Clone the repo:
git clone https://github.com/CERT-Polska/drakvuf-sandbox - Follow the detailed setup guide in
docs/installation.md. You'll need a host with Intel VT-x, a recent Linux distro, and some patience. - Use Docker Compose to spin up the backend (REST API, database, S3-like storage) and frontend.
If you want a quicker taste, check the screenshots folder in the repo — gives you a feel for the UI without setting up VMs.
For the brave: there's also a standalone drakvuf-cli (the core introspection library) that you can compile separately and run manually against any Windows VM.
Final Thoughts
DRAKVUF Sandbox is the kind of tool you wish existed when you needed to analyze a tricky piece of malware and didn't trust the sandbox provider. It's not for beginners — you need to understand virtualization and Windows internals to use it effectively — but for malware analysts, threat hunters, and red teamers, it's a serious weapon.
The agentless approach is the real deal. Modern malware already checks for VirtualBox Guest Additions, VMware Tools, or sandboxie drivers. With DRAKVUF, the "sandbox" is invisible. That alone makes it worth exploring.
One caveat: it's Windows-only for analysis (the guest), and the host must run Linux with KVM. So if your lab is all macOS, you'll need a Linux machine or a nested virtualization setup.
But if you're already in the Linux + Windows VM world, this is a no brainer to add to your toolkit.
Found this useful? Follow us @githubprojects for more developer tools and security projects.