Alternatives to CAPEv2
A self-hosted automated malware sandbox that extracts payloads and parses malware configurations. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
CAPEv2
A self-hosted automated malware sandbox that extracts payloads and parses malware configurations.
Replacements
Listings that take over the same core job as CAPEv2.
Triage
Online malware sandbox that runs submitted samples and reports their behavior and configuration.
Triage is a hosted sandbox with behavioral detections, config extraction and an API, so there is no VM setup, but it needs an account and advanced features are paid.
Hybrid Analysis
Free online sandbox that runs submitted files and URLs and reports on their behaviour.
Hybrid Analysis is a free hosted sandbox with nothing to install, but samples go to a third-party service and you lose CAPEv2's self-hosted payload extraction and config parsing.
Similar software
Related functionality, not a direct replacement.
capa
Identify likely capabilities inside executable files.
YARA
Pattern-matching engine for identifying and classifying malware samples.
REMnux
Linux toolkit for reverse engineering and analysing malicious software.
FLARE-VM
Installation scripts that turn a Windows virtual machine into a malware analysis and reverse-engineering workstation.
VirusTotal
Online service that checks a URL or file against many antivirus engines and URL scanners.
Volatility 3
Memory forensics framework for extracting artefacts from RAM images.
