CAPE Sandbox is an automated malware analysis system. You hand it a suspicious file, it runs that file inside an isolated virtual machine, and it returns a detailed report of everything the file tried to do. The name stands for Config And Payload Extraction. Kevin O’Reilly started the project in 2015 at Context Information Security, building on the Cuckoo Sandbox code base, and it was first shown in public at the 44CON conference in September 2016.
The current branch, CAPEv2, appeared in October 2019 once Andriy Brukhovetskyy had ported the code to Python 3. It is released under the GPL v3, inherited from Cuckoo, in the kevoreilly/CAPEv2 repository on GitHub, which showed around 3,400 stars and nearly 600 forks when we checked.
What CAPE Sandbox is for
Dynamic analysis rests on a simple observation: malicious code shows its hand when it actually runs. CAPE therefore spins up a clean Windows virtual machine, drops the sample inside, launches it and watches. A monitor injected into running processes hooks calls to system functions, so the report can list the files written, registry keys changed, processes started and network connections opened. Traffic is saved as a PCAP file, screenshots are taken along the way, and a full memory dump of the guest can be kept. The machine is then rolled back to its clean state, ready for the next sample.
What sets CAPE apart from its ancestor is right there in the name. A lot of malware arrives packed or encrypted, and the real payload only appears in memory at run time. CAPE captures it automatically, classifies it with YARA rules and extracts its configuration, meaning command and control addresses, encryption keys or campaign identifiers. Those details go straight to the teams that need to block a threat or tie it to a known family. A built-in debugger, which YARA rules have been able to drive since 2021, also helps get past the traps some samples set for sandboxes, such as timing checks or virtual machine detection.
Cuckoo Sandbox, the project CAPE grew out of, is no longer maintained. Its last release dates from June 2019 and its repository was archived in April 2021, so many teams have moved to CAPE. Memory dumps can be examined with Volatility, extracted payloads loaded into Ghidra or IDA Pro for static analysis, and captured traffic checked against Suricata, which the documentation lists among its integrations. A web interface, a REST API and a distributed mode spanning several servers make it easy to fit into an automated pipeline.
Who is it for?
CAPE is built for malware analysts, incident response teams, security operations centers and threat intelligence researchers who receive far more samples than anyone could examine by hand. If you want a first look without installing anything, the README points to a free demonstration instance at capesandbox.com, available once an account has been activated.
Setting it up is a job for someone with experience. The repository recommends an Ubuntu 24.04 LTS host, the KVM hypervisor and a Windows 10 or Windows 11 guest that you build yourself, with Python, the analysis agent, network settings and a system stripped of background noise. Expect to need a server with plenty of memory, solid Linux administration skills and real discipline around network isolation, since the samples are live. CAPE is not an antivirus and protects no workstation. For monitoring a fleet of machines, Wazuh or Suricata is a better fit.
Download CAPE Sandbox safely
The official source is the kevoreilly/CAPEv2 repository on GitHub, together with the documentation at capev2.readthedocs.io. The project ships no installer and no prebuilt image. You fetch the repository and run the two provided scripts, one that prepares KVM and one that installs CAPE itself. The README explicitly asks you to read and understand them first, which is sensible advice for scripts that run with administrator rights. The software costs nothing and has no commercial edition.
Plenty of copies of the repository sit under other GitHub accounts, many of them frozen at an old commit. An analysis machine handles hostile code by design, so a tampered build of the tool itself would open a serious hole in the lab. Stick to the original repository and keep up with its updates.
Frequently asked questions
Is CAPE Sandbox free?
Yes. The code is released under the GPL v3 and there is no paid edition. The public demonstration instance mentioned by the project is free as well, once your account has been activated.
How does CAPE differ from Cuckoo Sandbox?
CAPE was derived from the first version of Cuckoo and adds automatic unpacking, configuration extraction and a debugger. More importantly, Cuckoo has gone unmaintained for years, while CAPE still receives regular updates.
Can CAPE run on Windows?
Not as a host. CAPE must be installed on Linux, and the project recommends Ubuntu 24.04 LTS. Windows is used as the guest system inside the virtual machines where samples run, and Linux guests are supported too.
