AwesomeREA.org

Tool

DRAKVUF Sandbox

CERT Polska’s automated black-box malware analysis system built on the DRAKVUF engine, which observes a Windows guest from the Xen hypervisor through virtual machine introspection rather than an agent installed in the guest. Samples submitted through the web interface or the CLI run in a restored snapshot, and the report covers the process tree, WinAPI, file and network activity, a PCAP, intercepted TLS keys, memory dumps, screenshots and capa-based TTP indicators. A drakrun installer builds the Windows guest, its snapshot and the VMI profile.

Requirements & limits

  • The reviewed master commit is the v0.21.0 release of 2026-08-19, which GitHub ships as a Python wheel; the drakvuf-sandbox package provides the drakrun CLI, web application and workers, needs Python 3.9+ and pins its dependencies, including flare-capa 7.4.0. The host needs an Intel CPU with VT-x and EPT and Debian 12 or Ubuntu 22.04 booted through GRUB into Xen 4.17+ (4.19 recommended); the getting-started guide asks for at least two cores and 8 GB of RAM, while the README says 5 GB. Xen, LibVMI and the DRAKVUF engine come from prebuilt .deb packages or source builds, Redis, dnsmasq, tcpdump and other host packages are added, and the documented installation runs as root.
  • Guests are Windows 10 x64 (build 2004 or later, 22H2 recommended) or Windows 7 x64, installed by drakrun install from a Windows installation ISO the user supplies and completed over VNC, then snapshotted and profiled by drakrun postinstall. The guide suggests turning off UAC and Windows Defender in the reference snapshot and adding Visual C++ and .NET runtimes, and each analysis can cut the guest’s internet access. Nested virtualization works under Xen, under KVM as experimental, and under VMware Workstation with virtualized EPT; cloud hosts, Hyper-V and VMware Fusion are unsupported.
  • Observations come from DRAKVUF plugins: apimon, filetracer, memdump, procmon, socketmon and tlsmon by default, with regmon, syscalls, exmon and others optional and Intel Processor Trace plugins documented as experimental. The docs warn that many plugins slow execution, that monitoring begins only after the sample process starts, and that summary observations derive from DRAKVUF output, so exact network data should be checked in the PCAP. S3 storage, a ZFS storage backend and Karton integration are optional.
  • Profiling injects a small drakshell shellcode agent into explorer.exe for preparation commands. The repository carries source for drakshell and other guest helpers, a 15 KB test/test.exe sample used by its sanity test, and pinned DRAKVUF and Mandiant capa-rules submodules. That test suite installs the sandbox on a VM-runner service needing project credentials, while the public workflow only builds the docs, tools, web bundle and wheel and lints the Python code. The README warns that maintaining a sandbox is difficult and bugs may reproduce only on one configuration; this collection reviewed source and documentation without installing it or analysing any sample.
  • LICENSE applies GPL-2.0 with the authors’ added clarifications and exceptions, including a broad reading of derivative works and a bar on combining it with plain-GPL software, so GitHub reports no standard license; DRAKVUF and the capa rules keep their own licenses, and Windows guests remain under Microsoft’s terms. It is a defensive platform for running untrusted samples in isolated guests, and this record describes no evasion technique. The reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  2. docs/usage/getting_started.rst GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  3. docs/usage/basic_usage.rst GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  4. docs/usage/optional_features.rst GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  5. docs/ipt.rst GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  6. setup.py GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  7. requirements.txt GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  8. .gitmodules GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  9. test/test_sanity.py GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  10. test/conftest.py GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  11. .github/workflows/build.yml GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  12. LICENSE GitHub · CERT-Polska/drakvuf-sandbox · Revision 7c328ab
  13. https://github.com/CERT-Polska/drakvuf-sandbox/releases/tag/v0.21.0

More in Native binaries

All 97 entries in Native binaries