A cyberanalyst is looking for an open source malware analysis tool that can run locally on the network. Which tool would meet the needs of the cyberanalyst?

A cyberanalyst is looking for an open source malware analysis tool that can run locally on the network. Which tool would meet the needs of the cyberanalyst?

• A. ANY.RUN
• B. VirusTotal
• C. Cuckoo Sandbox
• D. Wireshark

Answer: (C)

To analyze malware in a controlled, on-premises environment, you need a sandbox you can install and run on your own hardware. Cuckoo Sandbox fits this need as an open-source malware analysis framework that you deploy locally, often using virtual machines (VirtualBox, VMware, KVM, etc.) to execute samples in isolation. It automates dynamic analysis and provides detailed reports on how the sample behaves—filesystem changes, registry activity (on Windows), process activity, network traffic, and API calls—so you can study what the malware does without risking the broader network. Its local deployment means you control the environment, data, and access, which is essential for sensitive analyses. In contrast, the other options aren’t suited for this scenario. Any.RUN is a cloud-based sandbox, not something you run entirely within your own network or as open-source software. VirusTotal is an online scanning service that analyzes samples with multiple engines but doesn’t provide a local sandbox for executing and observing behavior. Wireshark is a network protocol analyzer used to inspect live or captured traffic; it doesn’t execute malware or provide a sandboxed environment for safe analysis.

To analyze malware in a controlled, on-premises environment, you need a sandbox you can install and run on your own hardware. Cuckoo Sandbox fits this need as an open-source malware analysis framework that you deploy locally, often using virtual machines (VirtualBox, VMware, KVM, etc.) to execute samples in isolation. It automates dynamic analysis and provides detailed reports on how the sample behaves—filesystem changes, registry activity (on Windows), process activity, network traffic, and API calls—so you can study what the malware does without risking the broader network. Its local deployment means you control the environment, data, and access, which is essential for sensitive analyses.

In contrast, the other options aren’t suited for this scenario. Any.RUN is a cloud-based sandbox, not something you run entirely within your own network or as open-source software. VirusTotal is an online scanning service that analyzes samples with multiple engines but doesn’t provide a local sandbox for executing and observing behavior. Wireshark is a network protocol analyzer used to inspect live or captured traffic; it doesn’t execute malware or provide a sandboxed environment for safe analysis.