Alternatives to Triage
Online malware sandbox that runs submitted samples and reports their behavior and configuration. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Triage
Online malware sandbox that runs submitted samples and reports their behavior and configuration.
Replacements
Listings that take over the same core job as Triage.
Hybrid Analysis
Free online sandbox that runs submitted files and URLs and reports on their behaviour.
Hybrid Analysis is a free online sandbox for files and URLs with behavioural reports, though submitted samples still go to a third-party service.
CAPEv2
A self-hosted automated malware sandbox that extracts payloads and parses malware configurations.
CAPEv2 is an open-source sandbox you host yourself with payload extraction and config parsing, but requires a complex setup with analysis virtual machines.
VirusTotal
Online service that checks a URL or file against many antivirus engines and URL scanners.
VirusTotal is free and aggregates verdicts from many antivirus engines for files and URLs rather than detonating samples for detailed behaviour reports.
Similar software
Related functionality, not a direct replacement.
urlscan.io
Sandbox for the web that loads a URL and records screenshots, requests and indicators.
capa
Identify likely capabilities inside executable files.
YARA
Pattern-matching engine for identifying and classifying malware samples.
REMnux
Linux toolkit for reverse engineering and analysing malicious software.
FLARE-VM
Installation scripts that turn a Windows virtual machine into a malware analysis and reverse-engineering workstation.
MISP
An open-source threat intelligence platform for sharing, storing and correlating indicators of compromise.
