Malwagon

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

Malwagon is ranked #2 of 24 in malware analysis sandboxes on Inferse. It runs on API, Linux, macOS, Web, Windows. There is a free plan. Paid plans start at $79/mo.

Compared on malware analysis sandboxes

Free plan: Yesmalwagon.com
Paid from: $79/momalwagon.com
URL analysis: Yesmalwagon.com
API access: Yesmalwagon.com
Network traffic analysis: Yesmalwagon.com
IOC extraction: Yesmalwagon.com
File size limit: 128 MBmalwagon.com
Deployment model: cloudmalwagon.com

Facts

What it does: Malwagon is an automated malware analysis sandbox that analyzes files, URLs, commands, documents, packages and Windows kernel drivers in isolated virtual machines and returns scored verdicts with evidence.malwagon.com · 30 Sept 2026
Analysis layers: Static analysis includes YARA, capability identification, obfuscated-string recovery, packer and entropy checks, signature scanning, disassembly, secrets scanning and configuration extraction.malwagon.com · 30 Sept 2026
Dynamic analysis: Dynamic analysis records ETW kernel telemetry, memory forensics, hypervisor introspection, network capture and JA3/JA4 fingerprints.malwagon.com · 30 Sept 2026
Detection outputs: Reports can include MITRE ATT&CK mappings and generated YARA, Sigma and Suricata rules, with exports to ATT&CK Navigator, STIX 2.1, MISP, defanged IOC lists, PDF and DOCX.malwagon.com · 30 Sept 2026
Supported submissions: The platform accepts executables and archives up to 128 MB, URLs, PowerShell/CMD/bash commands, office and PDF documents, Windows kernel drivers, pip packages and MD5/SHA-1/SHA-256 hashes.malwagon.com · 30 Sept 2026
Hypervisor isolation: Each analysis runs in its own full virtual machine under a kernel-level hypervisor, and the machine is discarded after the run.malwagon.com · 30 Sept 2026
Report visibility: Free-tier reports are publicly viewable, while paid plans can keep scans private and Ultra Privacy deletes stored scan data after analysis.malwagon.com · 30 Sept 2026
Integrations: The service provides a bearer-token REST API, an MCP server at https://malwagon.com/mcp, and a Python CLI installable with pip.malwagon.com · 30 Sept 2026
CLI platforms: The Malwagon CLI has no dependencies and runs on Linux, macOS and Windows.malwagon.com · 30 Sept 2026
Who it is for: Malwagon is designed for incident responders, detection engineers, SOC analysts and threat researchers, while unauthenticated users can submit untrusted attachments and read reports.malwagon.com · 30 Sept 2026
Support and disclosure: Platform questions, vulnerability reports and takedown requests are handled through the contact page and [email protected]; Malwagon states that it has no bug-bounty program.malwagon.com · 30 Sept 2026