AwesomeREA.org

Tool

CAPE Sandbox (CAPEv2)

Malware sandbox derived from Cuckoo v1 that runs samples in isolated Windows guests and records API-hook behavior, created and modified files, network traffic as PCAP, screenshots and memory dumps. Its capemon monitor adds automated unpacking, capturing injected, extracted or decompressed payloads and dumping process images, plus a debugger that YARA signatures or submission options can program with breakpoints and short instruction traces. Results are classified with YARA, Suricata and behavioral signatures, and malware configurations are extracted by parsers maintained in the separate CAPE-parsers package.

Requirements & limits

  • There are no releases or tags: the reviewed master commit of 2026-10-18 is a rolling snapshot, with changes recorded in changelog.md, and pyproject.toml carries the placeholder version 0.1.0. The README recommends an Ubuntu 24.04 LTS host with KVM and Python 3.10 or 3.12, and Windows 10 or Windows 11 23H2 guests running agent.py under 32-bit Python 3.7.2 or 3.8. The kvm-qemu.sh and cape2.sh installers must be edited before use, only the rooter component runs as root, and the README asks users to read every file in conf/.
  • Users supply the samples and their own Windows guest VMs; the repository ships no guest operating system. The Windows analyzer bundles helper binaries: the capemon.dll and capemon_x64.dll monitors and the loader.exe and loader_x64.exe loaders, built from the separate GPL-3.0 capemon repository; PPLinject and version.dll helpers whose source the reviewed files do not identify; and third-party tools under their publishers' own terms, namely Sysinternals PsExec, signtool.exe from the Windows SDK and the AutoIt3 interpreter.
  • CI runs ruff, the pytest suites for the core, web interface and Linux analyzer, and mypy on Ubuntu 22.04 with Python 3.10 after a recursive checkout, plus pytest for the Windows analyzer on Windows. These check the framework's code, not detection or unpacking quality, and the README warns that configuration parsers can break as malware families change. A recursive clone also fetches the CAPE-TestFiles unit-test submodule, which includes a malware folder.
  • LICENSE applies GPL-3.0 under a Cuckoo Foundation notice, which GitHub reports as NOASSERTION; the bundled Microsoft and AutoIt executables are not covered by it. Analysis executes malicious files, which the README places in an isolated environment. The reviewed sources state no REA use, and no sample was run for this record.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · kevoreilly/CAPEv2 · Revision 38c34af
  2. LICENSE GitHub · kevoreilly/CAPEv2 · Revision 38c34af
  3. analyzer/windows/bin GitHub · kevoreilly/CAPEv2 · Revision 38c34af
  4. analyzer/windows/dll GitHub · kevoreilly/CAPEv2 · Revision 38c34af
  5. .gitmodules GitHub · kevoreilly/CAPEv2 · Revision 38c34af
  6. pyproject.toml GitHub · kevoreilly/CAPEv2 · Revision 38c34af
  7. changelog.md GitHub · kevoreilly/CAPEv2 · Revision 38c34af
  8. .github/workflows/python-package.yml GitHub · kevoreilly/CAPEv2 · Revision 38c34af
  9. .github/workflows/python-package-windows.yml GitHub · kevoreilly/CAPEv2 · Revision 38c34af
  10. README.md GitHub · kevoreilly/capemon · Revision b22d3d6

More in Native binaries

All 97 entries in Native binaries