CAPEv2
open-sourceThe section your link pointed to isn't on CAPEv2's page any more, so we've brought you to the top.
CAPEv2 is a malware sandbox that executes malicious files in an isolated environment whilst instrumenting their dynamic behaviour and collecting forensic artefacts.
python utils/tenancy_reconcile.py --dry-run --adopt-public-from-reports
python utils/tenancy_reconcile.py --task 14
from lib.cuckoo.common.hooks import register_mongo_filter
def my_tenant_filter(query: dict) -> dict:
query['info.tenant_id'] = MY_TENANT_ID
return query
register_mongo_filter(my_tenant_filter)
from lib.cuckoo.common.hooks import register_sql_task_filter
def my_sql_filter(query):
from lib.cuckoo.core.data.task import Task
return query.filter(Task.owner == MY_USER_ID)
register_sql_task_filter(my_sql_filter)
json_logs = on
color_logs = off
CAPE_JSON_LOGS=1 python3 cuckoo.py
enforce_timeout = yes
python utils/agent_worktree.py new --pr 3219
python utils/agent_worktree.py list
python utils/agent_worktree.py cleanup --all
poetry install --extras azure
bash installer/cape2.sh all 192.168.1.1 | tee cape2.sh.log
python utils/cleaners.py --banned-clean --db-batch-size 5000
sudo bash extra/linux_agent.sh && sudo bash extra/tracee.sh
[magika]
enabled = yes
Summary
CAPEv2 is an open-source malware sandbox, free to use, that runs suspicious files in an isolated Windows or Linux environment while instrumenting their behavior and capturing forensic artefacts like process activity, network traffic (PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.), screenshots, and full memory dumps. It is deployed as a self-hosted service, typically distributed across dedicated analysis machines, and a free hosted demo instance exists for anyone to try before standing up their own. It targets malware analysts and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams doing incident response rather than developers or compliance staff, and its README traces its lineage from Cuckoo Sandbox, positioning itself as a successor that adds automated unpacking, YARA-driven config extraction, and threat-intelligence enrichment via ThreatFox and Malpedia. First committed in 2019, it remains under active development with over 200 contributors and roughly 900 commits in the past year.
CAPEv2 is a malware sandbox that executes malicious files in an isolated environment whilst instrumenting their dynamic behaviour and collecting forensic artefacts.
How CAPEv2 helps
What is this file actually doing once it runs, not just what it looks like statically?
executes the sample in an isolated Windows or Linux environment while hooking its API calls, then reports the processes, files created or deleted, and registry changes it produced
Is this binary talking to anything on the network, and to whom?
captures full network traffic as a PCAP alongside the run, so contacted hosts and protocols can be inspected directly
Which malware family is this, and does it match something already catalogued?
classifies the sample against behavioral and network signatures and against YARA rules on the unpacked payload, then cross-references contacted IPs and domains with ThreatFox and pulls family cards from Malpedia
Can this sample's configuration be pulled out without reverse-engineering it by hand?
runs static and dynamic configuration extraction plus an automated unpacking stage driven by YARA-programmable debugger signatures, so the decrypted config surfaces without manual unpacking
What did the malware do to memory and the desktop that a log wouldn't show?
takes screenshots of the desktop during execution and produces full memory dumps of the target system for later forensic review
Did a dropped file get misclassified because it has no recognizable header?
runs the file through a deep-learning content-type model that labels script types and headerless payloads that traditional signature-based typing would only mark as unidentified data
Languages
Command line
No command matches.
| option | found in | since | description |
|---|
Values are placeholders taken from each option’s declared default. Nothing is executed here — the output shown is a recording of a run that already happened.
Screenshots
From the release notes, newest first. Click one to see it full size.Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
- Community health
-
Contributor trend distinct committers, this year against last
-
Maintainer concentration bus factor now against a year ago
-
Issue backlog trend issues closed per issue opened, 12 months
-
Responsiveness median time to a maintainer’s first reply
Nine scores for CAPEv2, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail CAPEv2 puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Releases
20 entries
No entries match these filters.
- November 20261
- October 20265
- September 20264
- August 202610
Project health
Issue, contributor and maintainer activity in kevoreilly/CAPEv2, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.
- Contributors 47 +6 vs prior 12 months
- Maintainers 7 +7 joined · −6 left, last 12 months
- Bus factor 3 committers behind half the commits
- Community-filed 96% of issues opened, last 12 months
- Median time to close 31 days first maintainer reply 2.1 hours
- Open backlog 7 of 928 issues ever filed
- Issues opened / month 3 · 0 communitymaintainers
- Open backlog 7
- Contributors / month 8
- Commits / month 29
- Stars 3,499
- features 1%
- other 99%
Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this
Libraries its release ships
What its latest release locks, checked against known advisories.We can only check tools that publish GitHub releases.
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →