Malwagon

Malwagon is an automated malware analysis sandbox. Submit a file, a hash, a URL, a command line, a document, a pip package or a Windows kernel driver, and it is analysed statically and detonated in an isolated virtual machine on dedicated hardware, returning a scored verdict with the indicators and detection rules behind it.

Behaviour is recorded agentless at the hypervisor layer rather than by software installed inside the guest, so there is no in-guest agent for a sample to find, unhook or disable. The analysis runs on real virtual machines, not an emulator and not a container.

A dedicated Kernel Driver module handles Bring Your Own Vulnerable Driver: it reports the IOCTL dispatch surface, the privileged hardware access in the code, the signing and mitigation state, an ATT&CK mapping in kill-chain order and generated Sigma rules.

Four analysis layers contribute to one auditable score: static analysis (PE structure, packing, signing, capability detection, YARA, strings), dynamic analysis (process tree, file and registry activity, network, persistence, memory, screen recording), threat intelligence enrichment, and an AI narrative layer that receives only locally derived data and never the sample itself.

Analysts can watch the detonation live over VNC while the sample runs. Reports export to STIX 2.1, MISP, ATT&CK Navigator and defanged IOC lists. A REST API, an MCP server for AI clients, and a command line client (pip install malwagon) automate submissions.

Three free scans a day with no account. A free Community account adds a personal history and API access; paid plans add internet egress from the sandbox, threat intelligence enrichment, the AI narrative and private reports.