I am in search of looking an open source sandbox that has the following features: - route my network traffic to the sandbox for analysis - perform analysis on network traffic to detect malicious activities or generate intelligence from traffic what I am mostly interested is to route netflow data if possible! I have checked cuckoo sandbox but it only has the ability to submit samples! I could not find a way that I can route my network traffic to cuckoo.
Detux is a sandbox developed to do traffic analysis of the Linux malwares and capture the IOCs by doing so.
Detux logs network data including IP addresses the program sends signals to, DNS queries, URLs accessed and TCP raw streams:
If you are performing analysis of Windows PE binaries then FakeNet may be of interest to you:
FakeNet is [a] Windows network simulation tool designed for malware analysis. It redirects all traffic leaving a machine to the localhost (including hard-coded IP traffic and DNS traffic) and implements several protocols to ensure that malicious code continues to execute and can be observed by an analyst.
The tool supports DNS, HTTP, and SSL protocols and provides a python extension interface for implementing new or custom protocols. It also the capability to listen for traffic to any port as well as create packet capture on the localhost.
Right now the tool only supports WinXP Service Pack 3. The tool runs fine on Windows Vista/7 although certain features will be automatically disabled.
Note that FakeNet is not a sandbox but is employed when analyzing binaries on an isolated system.
If neither of these tools are what you are looking for, here is a long list of online scanners and sandboxes: https://github.com/rshipp/awesome-malware-analysis#online-scanners-and-sandboxes and here is Lenny Zeltser's list of free automated malware analysis sandboxes and services: https://zeltser.com/automated-malware-analysis/
If there is no tool that meets your requirements you can always create your own analysis lab. Books that will provide guidance for such an endeavor include "Practical Malware Analysis" by Honig and Sikorski (creators of FakeNet) and "Malware Analyst's Cookbook" by Ligh and Adair.
Sandboxie is shareware software. The free version is missing a few features which are available in the paid version. After 30 days of use, the free version displays reminders to upgrade to the paid version, but remains functional. For personal use, you are encouraged, but not required, to upgrade to the paid version. For non-personal use (including commercial, educational, governmental, and not-for-profit use), Sandboxie must be properly licensed. See Commercial Licensing.