Analyze Malware with Precision
Self-hosted malware analysis platform with isolated Docker sandboxes, real-time WebSocket telemetry, and MITRE ATT&CK mapping. Your data never leaves your infrastructure.
Built with enterprise-grade technologies
Enterprise-Grade Features
Everything you need for comprehensive malware analysis, from static inspection to dynamic sandboxing and threat intelligence integration.
Static Analysis
YARA rules, entropy analysis, PE/ELF parsing, and 150+ string patterns for comprehensive file inspection.
Dynamic Sandbox
Ubuntu 22.04 containers with strace/ltrace/tcpdump for syscall tracing and behavior monitoring.
Browser Sandbox
Pardus Linux + Firefox ESR with noVNC for safe URL detonation with live video streaming.
Network Analysis
PCAP parsing, JA3 TLS fingerprinting, beaconing detection, and suspicious port monitoring.
MITRE ATT&CK
Automatic syscall-to-technique mapping with dashboard visualization of top attack patterns.
Risk Scoring
0-100 scoring system with 5 severity levels. Automatic quarantine for high-risk samples.
Threat Intel
VirusTotal integration with 24h Redis cache, IOC extraction, STIX 2.1 and CSV export.
AES-256 Quarantine
Infected samples encrypted with pyzipper AES-256 for secure isolation and handling.
Real-time Telemetry
Redis pub/sub to WebSocket for live event streaming. Watch analysis unfold in real-time.
HA PostgreSQL
Patroni 3-node cluster with etcd DCS and HAProxy for high availability and RW/RO split.
USOM Integration
TR-CERT URL blacklist with automatic daily updates at 03:00 UTC for threat protection.
Kubernetes Ready
Kustomize overlays, NetworkPolicy isolation, dynamic Job spawning, and full RBAC support.
Comprehensive Analysis Pipeline
From rapid static checks to deep behavioral analysis — our multi-phase pipeline ensures no threat goes undetected.
Fast initial inspection without execution
- Hash calculation (SHA256/MD5/SHA1/ssdeep)
- MIME type detection & entropy analysis
- PE/ELF binary parsing
- YARA rule matching
- VirusTotal lookup (cached 24h)
Behavioral analysis in isolated container
- strace syscall tracing
- Process tree construction
- File system monitoring
- Registry & config changes
- Internal network (no internet)
Advanced network and threat analysis
- PCAP network capture & analysis
- JA3/JA3S TLS fingerprinting
- Beaconing pattern detection
- MITRE ATT&CK technique mapping
- Suspicious port monitoring (16 ports)
Total analysis time: ~12 minutes for complete deep analysis
See TRACE in Action
Explore the powerful interface designed for security analysts.
Analysis Dashboard
Real-time overview of all analyses with risk distribution, MITRE ATT&CK top techniques, and activity timeline.
Enterprise Architecture
Microservices architecture with high availability, network isolation, and real-time event streaming.
Why Self-Host?
Keep your malware samples where they belong — in your own infrastructure. Full control, complete privacy, unlimited analysis.
Complete Data Privacy
All analysis happens on your infrastructure. Sensitive files and malware samples never leave your network.
Zero data exfiltrationCompliance Ready
Meet regulatory requirements for data residency. Perfect for government, finance, and healthcare sectors.
GDPR, HIPAA, SOC 2Air-Gap Compatible
Deploy in fully isolated environments. VirusTotal integration is optional — full offline operation supported.
No internet requiredFull Transparency
Open source codebase. Audit every line of code. No black boxes, no hidden telemetry.
MIT LicenseUnlimited Customization
Modify YARA rules, adjust risk thresholds, extend analysis phases. The platform adapts to your needs.
Your rules, your wayNo API Limits
Analyze as many samples as your hardware allows. No quotas, no rate limits, no per-scan fees.
Unlimited scansSelf-Hosted vs Cloud Solutions
| Feature | TRACE (Self-Hosted) | Cloud Services |
|---|---|---|
| Data Location | Your servers | Third-party cloud |
| API Limits | Unlimited | Quota-based |
| Cost Model | One-time setup | Per-scan fees |
| Customization | Full access | Limited |
| Offline Mode | Supported | Not possible |
| Source Code | Open source | Closed |
Open Source. Enterprise Ready.
Start with our fully-featured open source version. Upgrade to enterprise when you need dedicated support and custom development.
Free forever for individuals and small teams
- Full platform access
- 3-phase analysis pipeline
- Static + Dynamic analysis
- Browser sandbox
- MITRE ATT&CK mapping
- Docker Compose deployment
- Community support
- Self-managed infrastructure
For organizations requiring dedicated support
- Everything in Open Source
- Kubernetes deployment support
- Custom YARA rule development
- Priority security updates
- SLA-backed support
- Training & onboarding
- Custom integrations
- Dedicated account manager
Enterprise Services Include
Security Consulting
Custom deployment review and hardening recommendations
On-Site Training
Train your SOC team on advanced malware analysis techniques
24/7 Support
Direct access to engineering team for critical issues
Custom Development
New features and integrations tailored to your workflow