Agentless malware detonation and behavioral analysis at the hypervisor layer, with threat intelligence and detection engineering workflows for security operations and malware research.
Open Malwagon · Documentation · API Reference · Public Analysis
Malwagon is an agentless malware analysis sandbox built around hypervisor layer observation for security analysts, incident response teams, detection engineers and malware researchers.
Suspicious files, URLs, command lines, documents, software packages and Windows kernel drivers are analyzed inside disposable Windows and Linux virtual machines.
Analysis combines execution telemetry, network activity, process behavior, registry activity, memory artifacts, screenshots, extracted indicators, threat intelligence and detection content into a single technical report.
Malwagon is designed so that core observation does not depend on an analysis agent running inside the guest operating system. Telemetry collected at the hypervisor and virtualization layers provides an external view of execution while disposable virtual machines isolate each detonation.
| Module | Scope |
|---|---|
| 📦 File Analysis | PE, EXE, DLL, .NET, ELF, Go binaries, scripts and archives |
| 🌐 URL Analysis | Browser execution, redirects, page activity, content and screenshots |
| ⌨️ Command Analysis | PowerShell, CMD and Bash execution with behavioral observation |
| 📄 Document Analysis | Office documents, PDF, RTF, OneNote, CHM, macros, embedded objects and template injection |
| 🧩 Kernel Driver Analysis | Windows kernel drivers, IOCTL inspection, imports, signing metadata and BYOVD indicators |
| 🐍 Package Analysis | Python package installation behavior and Linux syscall activity |
| 🔎 Hash Intelligence | MD5, SHA1 and SHA256 reputation and historical analysis lookup |
| 🖥️ OneShot | Execution across selected sandbox images for rapid environment comparison |
Malwagon is designed to inspect what suspicious code actually does during execution.
Depending on the analysis type and selected environment, a run can include:
- process creation and execution chains
- command line activity
- registry activity
- network connections and packet capture
- filesystem activity
- memory acquisition
- process dumps
- injected PE extraction
- screenshots
- extracted indicators
- behavioral scoring
- threat intelligence enrichment
- MITRE ATT&CK mapping
- detection rule generation
Windows and Linux analysis environments can be selected according to the target and investigation requirements.
Analysis results can be used directly in security operations, threat research and detection engineering workflows.
Observed behavior is mapped to MITRE ATT&CK tactics and techniques, allowing analysts to review behavior against a standardized adversary knowledge base.
File structure, strings and other relevant characteristics can be used to derive YARA detection logic.
Process activity, registry modifications, command execution and related operating system telemetry can be translated into Sigma detection rules.
Network activity recorded during execution can be used to produce Suricata detection content.
Hashes, domains, IP addresses and other derived indicators can be enriched against threat intelligence sources.
Analysis data can also be exported into formats used by security operations and threat intelligence workflows, including STIX 2.1 and MISP.
Windows kernel drivers require a different analysis workflow from ordinary user mode executables.
Malwagon provides dedicated driver analysis covering areas such as:
- exposed IOCTL control codes
- user mode reachable primitives
- kernel imports
- driver signing information
- known vulnerable driver indicators
- BYOVD relevance
- security control bypass indicators
- kernel tampering related capabilities
This workflow is intended for driver research, vulnerable driver investigation and analysis of kernel level attack primitives.
Samples are executed inside dedicated disposable virtual machines.
Isolated analysis networks can prevent the guest from reaching external infrastructure. Analysis requiring connectivity can use controlled network access according to the selected environment.
Submitted sample bytes remain within the Malwagon analysis infrastructure. External reputation and intelligence queries use hashes and derived indicators rather than submitting the original malware sample to third party analysis services.
This separation allows external enrichment while keeping the submitted binary within the Malwagon analysis environment.
More information:
Malwagon provides programmatic access for integration with existing security workflows.
The REST API uses bearer token authentication and supports controlled access for analysis, lookup and automation use cases.
Typical integrations include:
- SOC investigation workflows
- incident response pipelines
- malware triage systems
- threat intelligence platforms
- detection engineering pipelines
- security research tooling
- automated hash reputation checks
- URL analysis workflows
- package security analysis
- internal security portals
API credentials can be managed independently and issued according to the required access scope.
This GitHub organization hosts software maintained for the Malwagon ecosystem.
Repositories published under the Malwagon organization may include:
- command line clients
- Python packages
- SDKs
- REST API integrations
- malware analysis utilities
- detection engineering tools
- threat research tooling
- workflow automation
- analysis helpers
- reference implementations
Software published by this organization is intended to provide supported interfaces between Malwagon and security engineering workflows.
Malwagon is built for technical environments where suspicious code must be executed, observed and investigated.
| Use Case | Application |
|---|---|
| 🔬 Malware Research | Behavioral investigation and artifact collection |
| 🚨 Incident Response | Rapid triage of suspicious files, URLs and commands |
| 🛡️ SOC Operations | Evidence collection and enrichment for security investigations |
| 🎯 Threat Hunting | Indicator extraction and behavioral correlation |
| 📐 Detection Engineering | YARA, Sigma, Suricata and ATT&CK aligned detection content |
| 🧠 Reverse Engineering | Runtime context for deeper manual analysis |
| 📄 Document Analysis | Suspicious Office, PDF and related document investigation |
| 📦 Supply Chain Analysis | Package behavior inspection |
| ⚙️ Kernel Research | Windows driver and BYOVD investigation |
Malwagon is an agentless, hypervisor layer malware analysis sandbox that executes suspicious workloads inside isolated virtual machines and records their behavior for security investigation.
Malwagon supports malware files, URLs, shell commands, documents, software packages, file hashes and Windows kernel drivers.
A suspicious workload is executed inside an isolated analysis environment. Runtime telemetry, network activity, memory state, operating system behavior and generated artifacts are collected and assembled into a technical analysis report.
Yes. Malwagon includes a dedicated Windows kernel driver analysis workflow covering IOCTL exposure, imports, signing information and known BYOVD indicators.
The original submitted sample remains within Malwagon infrastructure. External reputation and intelligence services receive hashes and derived indicators instead of the original malware file.
Malwagon analysis data can be used to produce YARA, Sigma and Suricata detection content. Behavioral findings can also be mapped to MITRE ATT&CK.
Yes. Malwagon provides a REST API for supported analysis, lookup and automation workflows.
| Resource | Link |
|---|---|
| 🌐 Website | https://malwagon.com |
| 🔬 Platform | https://malwagon.com/platform |
| 📚 Documentation | https://malwagon.com/docs |
| ⚙️ API Reference | https://malwagon.com/docs/api |
| 🔐 Security | https://malwagon.com/security |
| 🔎 Public Analysis | https://malwagon.com/public |
| 📝 Blog | https://malwagon.com/blog |
| 🟢 Service Status | https://malwagon.com/status |
Malwagon
Agentless hypervisor layer malware analysis infrastructure for security operations, incident response, malware research and detection engineering.