ANY.RUN Sandbox

About

ANY.RUN is a leading provider of malware analysis and threat intelligence services, trusted by over 500,000 cybersecurity professionals worldwide.

This extension allows you to submit files and URLs for analysis using ANY.RUN's Interactive Sandbox and Safebrowsing services.
 
Interactive Sandbox Features:
- File and Link Analysis: Analyze files and links on fully interactive Windows (7-11 version) cloud virtual machines (VMs).
- Comprehensive Threat Reports: Generate detailed threat reports in JSON, MISP, and HTML formats, including IOCs and malware configurations.
- Malicious Behavior Monitoring: Observe samples' malicious behavior and study tactics, techniques, and procedures (TTPs) using the MITRE ATT&CK Matrix.
- Customizable Settings: Adjust settings for system reboot, locale selection, and network features like MITM proxy and FakeNET.
- Extended Analysis: Run VMs for up to 1200 seconds for in-depth analysis.

To use the sandbox functionality, you need access to ANY.RUN's API. Each analysis session launched through the extension counts towards your API quota.
 
Safebrowsing Features:
- Secure Browsing: Open URLs within a secure, isolated, and full-size virtual browser.
- Real-Time Threat Detection: Observe network traffic for malicious activity to detect threats in real time.
- Data Download: Download traffic data and identified indicators of compromise.
- Session Sharing: Share completed sessions as evidence of malicious content.

Safebrowsing does not require API access and is available for all plans, including the free one.