{"id":9182,"date":"2024-10-15T08:57:59","date_gmt":"2024-10-15T08:57:59","guid":{"rendered":"\/cybersecurity-blog\/?p=9182"},"modified":"2024-10-15T09:17:23","modified_gmt":"2024-10-15T09:17:23","slug":"linux-malware-analysis-sandbox","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/","title":{"rendered":"ANY.RUN\u2019s Upgraded Linux Sandbox <br>for Fast and Secure Malware Analysis"},"content":{"rendered":"\n<p>At <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=updated_linux&amp;utm_term=151024&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">ANY.RUN<\/a>, we\u2019re always working to improve our services, and this time, we\u2019ve focused on making our <a href=\"https:\/\/any.run\/platforms\/linux\/\" target=\"_blank\" rel=\"noreferrer noopener\">Linux sandbox<\/a> even better. We&#8217;ve fine-tuned every detail to ensure it runs as smoothly and reliably as our <a href=\"https:\/\/any.run\/cybersecurity-blog\/windows-10-sandbox\/\" target=\"_blank\" rel=\"noreferrer noopener\">Windows<\/a> environment. \u00a0<\/p>\n\n\n\n<p>From bug fixes to feature enhancements, our Linux sandbox is now more powerful and stable than ever, giving you a seamless experience when analyzing Linux malware.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What\u2019s Updated in ANY.RUN\u2019s Linux Sandbox?&nbsp;<\/h2>\n\n\n\n<p>We\u2019ve packed our latest update with powerful new features and improvements that upgrade both performance and usability. \u00a0<\/p>\n\n\n\n<p>Here\u2019s what\u2019s new in our Linux sandbox and how these enhancements benefit you:&nbsp;<\/p>\n\n\n\n<p><strong>Stable Chrome browser by default<\/strong>: We&#8217;ve integrated a stable version of Chrome as the default browser for Linux environments. This ensures smoother, faster browsing and more reliable interaction with suspicious websites during your analysis sessions.&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"584\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagef-1-1024x584.png\" alt=\"\" class=\"wp-image-9183\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagef-1-1024x584.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagef-1-300x171.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagef-1-768x438.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagef-1-1536x876.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagef-1-2048x1168.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagef-1-370x211.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagef-1-270x154.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagef-1-740x422.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Chrome browser inside ANY.RUN\u2019s Linux sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n<p><strong>Improved process tree performance<\/strong>: We\u2019ve eliminated the lag that previously occurred when navigating the <a href=\"https:\/\/any.run\/cybersecurity-blog\/advanced-process-details\/\" target=\"_blank\" rel=\"noreferrer noopener\">process tree<\/a>. Now, you can explore process details without any delays, making malware behavior analysis much more efficient.\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"586\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image10-1-1024x586.png\" alt=\"\" class=\"wp-image-9184\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image10-1-1024x586.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image10-1-300x172.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image10-1-768x439.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image10-1-1536x879.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image10-1-2048x1172.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image10-1-370x212.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image10-1-270x154.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image10-1-740x423.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Improved process tree inside Linux sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n<p><strong>Additional file uploads for Linux<\/strong>: This means that you can now upload files in real time while an analysis session is running, enabling a more dynamic investigation process. Instead of having to restart or set up a new session for each file, you can simply upload more files during the current session.&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"521\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image11-2-1024x521.png\" alt=\"\" class=\"wp-image-9185\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image11-2-1024x521.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image11-2-300x153.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image11-2-768x391.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image11-2-1536x781.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image11-2-2048x1042.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image11-2-370x188.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image11-2-270x137.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image11-2-740x376.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Additional file uploads in updated Linux sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n<p><strong>File events tracking<\/strong>: This feature allows users to monitor and log every action the malware performs on files within the Linux sandbox environment. For example, if the malware creates, modifies, deletes, or moves files, those actions are now captured and presented in the analysis report.\u00a0<\/p>\n\n\n\n<!-- CTA Split START -->\n<div class=\"cta-split\">\n<div class=\"cta__split-left\">\n\n<!-- Image -->\n<img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/mcusercontent.com\/663b94f19348582a8dc323efe\/images\/0d88188b-3e89-2314-5a60-cb87e8077326.png\" alt=\"ANY.RUN cloud interactive sandbox interface\" class=\"cta__split-icon\" \/>\n<\/div>\n\n<div class=\"cta__split-right\">\n<div>\n\n<!-- Heading -->\n<h3 class=\"cta__split-heading\"><br>Analyze malware in Linux and Windows VMs<\/h3>\n\n<!-- Text -->\n<p class=\"cta__split-text\">\nSign up for a <span class=\"highlight\">free ANY.RUN account<\/span> to access interactive malware analysis with no limit.\n<br \/>\n<br \/>\n<b>Investigate any threat with ease<\/b>.\n<\/p>\n<\/div>\n<!-- CTA Link -->\n<a target=\"_blank\" rel=\"noopener\" id=\"article-banner-split\" href=\"https:\/\/app.any.run\/?utm_source=anyrunblog&#038;utm_medium=article&#038;utm_campaign=updated_linux&#038;utm_term=151024&#038;utm_content=linktoregistration#register\/\"><div class=\"cta__split-link\">Sign up<\/div><\/a>\n<\/div>\n<\/div>\n<!-- CTA Split END -->\n<!-- CTA Split Styles START -->\n<style>\n.cta-split {\noverflow: hidden;\nmargin: 3rem 0;\ndisplay: grid;\njustify-items: center;\nborder-radius: 0.5rem;\nwidth: 100%;\nmin-height: 25rem;\ngrid-template-columns: repeat(2, 1fr);\nborder: 1px solid rgba(75, 174, 227, 0.32);\nfont-family: 'Catamaran Bold';\n}\n\n.cta__split-left {\ndisplay: flex;\nalign-items: center;\njustify-content: center;\nheight: 100%;\nwidth: 100%;\nbackground-color: #161c59;\nbackground-position: center center;\nbackground: rgba(32, 168, 241, 0.1);\n}\n\n.cta__split-icon { \nwidth: 100%;\nheight: auto;\nobject-fit: contain;\nmax-width: 100%;\n}\n\n.cta__split-right {\ndisplay: flex;\nflex-direction: column;\njustify-content: space-between;\npadding: 2rem;\n}\n\n.cta__split-heading { font-size: 1.5rem; }\n\n.cta__split-text {\nmargin-top: 1rem;\nfont-family: Lato, Roboto, sans-serif;\n}\n\n.cta__split-link {\npadding: 0.5rem 1rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: white;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\ndisplay: block;\nz-index: 1000;\nposition: relative;\ncursor: pointer !important;\n}\n\n.cta__split-link:hover {\nbackground-color: #68CBFF;\ncolor: white;\ncursor: pointer;\n}\n\n.highlight { color: #ea2526;}\n\n\n\/* Mobile styles START *\/\n@media only screen and (max-width: 768px) {\n\n.cta-split {\ngrid-template-columns: 1fr;\nmin-height: auto;\n}\n\n.cta__split-left {\nheight: auto;\nmin-height: 10rem;\n}\n\n\n.cta__split-left, .cta__split-right {\nheight: auto;\n}\n\n.cta__split-heading { font-size: 1.2rem; }\n\n.cta__split-text { font-size: 1rem; }\n.cta__split-icon {\nmax-height: auto;\nobject-fit: cover;\n}\n\n}\n\/* Mobile styles END *\/\n<\/style>\n<!-- CTA Split Styles END -->\n\n\n\n<p>Now you can get a clearer view of how the malware interacts with the file system, providing deeper insights into the malware&#8217;s behavior and making it easier to trace malicious activities.&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"257\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image12-1-1024x257.png\" alt=\"\" class=\"wp-image-9186\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image12-1-1024x257.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image12-1-300x75.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image12-1-768x193.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image12-1-1536x385.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image12-1-370x93.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image12-1-270x68.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image12-1-740x186.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image12-1.png 1922w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>File modifications demonstrated in ANY.RUN\u2019s Linux sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n<p><strong>Clipboard feature<\/strong>: A new clipboard function has been introduced, allowing you to copy and paste content directly within the sandbox. This small addition significantly improves workflow and efficiency during interactive sessions.&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"477\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image13-1024x477.png\" alt=\"\" class=\"wp-image-9187\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image13-1024x477.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image13-300x140.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image13-768x358.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image13-1536x715.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image13-2048x954.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image13-370x172.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image13-270x126.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image13-740x345.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>VM Clipboard in Linux sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n<p><strong>Improved Locale (OS Language) selection: <\/strong>We\u2019ve enhanced the&nbsp;<strong>Locale (OS Language) choice<\/strong>&nbsp;feature in the Linux sandbox, making it more reliable and error-free. Now, during configuration, you can easily select the desired locale from the dropdown menu, ensuring that the operating system language is set correctly for your analysis session.&nbsp;<\/p>\n\n\n\n<p>This improvement is crucial because malware often behaves differently depending on the system&#8217;s language settings. For example, some malware may only activate in specific locales, or attackers may target systems based on region-specific characteristics. By choosing the correct locale, you can replicate real-world scenarios more accurately.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"798\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image14-1-1024x798.png\" alt=\"\" class=\"wp-image-9188\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image14-1-1024x798.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image14-1-300x234.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image14-1-768x599.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image14-1-1536x1197.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image14-1-370x288.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image14-1-270x210.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image14-1-385x300.png 385w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image14-1-740x577.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image14-1.png 1678w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Improved Locale selection in Linux sandbox<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<p><strong>Internal stability improvements<\/strong>: We\u2019ve also carried out&nbsp;other optimizations&nbsp;to ensure the Linux sandbox runs as smoothly and reliably as our Windows sandbox. &nbsp;<\/p>\n\n\n\n<p>These improvements include removing various bugs, making performance tweaks, and implementing backend updates. While these changes might not be immediately visible, they play a crucial role in enhancing the overall stability and efficiency of the Linux sandbox, giving you a seamless experience when analyzing malware.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Let\u2019s Analyze Mirai Malware in Linux Sandbox&nbsp;<\/h2>\n\n\n\n<p>To see the updated Linux sandbox in action, let\u2019s dive into how one of the most infamous Linux malware threats, <a href=\"https:\/\/any.run\/malware-trends\/mirai\" target=\"_blank\" rel=\"noreferrer noopener\">Mirai<\/a>, can be analyzed in just a few steps.\u00a0<\/p>\n\n\n\n<p>It\u2019s easy, fast and straightforward:\u00a0<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>1. Choose the right option for analysis&nbsp;<\/strong><\/h3>\n\n\n\n<p>To begin the analysis, we need to choose one of the options:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Upload the suspicious file<\/strong>: You can explore a variety of formats, including shell scripts, ELF executables, tarballs, and more. Even common files like Word documents, which might carry hidden malware targeting Linux, can be checked thoroughly.\u00a0<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Copy and paste the suspicious link<\/strong>: Safely browse shady websites, whether they&#8217;re suspected of hosting malware or trying to pull off phishing scams.&nbsp;<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"553\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image3-3-1024x553.png\" alt=\"\" class=\"wp-image-9189\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image3-3-1024x553.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image3-3-300x162.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image3-3-768x415.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image3-3-1536x830.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image3-3-370x200.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image3-3-270x146.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image3-3-740x400.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image3-3.png 1684w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Linux malware analysis options inside ANY.RUN<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\">2. Configure the sandbox settings<\/h3>\n\n\n\n<p>After selecting the option you need, you can adjust the sandbox settings. A key step is choosing &#8220;Linux OS&#8221; from the list of operating systems in the dropdown menu. This ensures the analysis session will run on a Linux system, providing the right environment for your testing.&nbsp;<\/p>\n\n\n\n<p>Ready? Hit that \u201cRun analysis\u201d button and start interacting with the file or link to check if it\u2019s malicious.&nbsp;<\/p>\n\n\n\n<p>In our case, we\u2019re running a <a href=\"https:\/\/app.any.run\/tasks\/09af831b-93f3-4dbe-bcd6-087f6c513575\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=updated_linux&amp;utm_term=151024&amp;utm_content=linktoservice\" target=\"_blank\" rel=\"noreferrer noopener\">malware analysis session<\/a> with Mirai:\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"590\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image4-1-1024x590.png\" alt=\"\" class=\"wp-image-9190\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image4-1-1024x590.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image4-1-300x173.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image4-1-768x442.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image4-1-1536x885.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image4-1-2048x1179.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image4-1-370x213.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image4-1-270x155.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image4-1-740x426.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Mirai malware analyzed in ANY.RUN\u2019s Linux sandbox<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\">3. Start analyzing the Linux malware\u00a0<\/h3>\n\n\n\n<p>After launching the analysis, the Linux sandbox will display tags related to the threat at hand.\u00a0\u00a0<\/p>\n\n\n\n<p>Just take a glance at the top-right corner of the screen. In our case, the sandbox provides tags &#8220;mirai&#8221; and &#8220;botnet&#8221;. <\/p>\n\n\n\n<p>Once you finish the analysis, the sandbox will show the final verdict, letting you know if the file or link is malicious or safe.\u00a0\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"315\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image5-2-1024x315.png\" alt=\"\" class=\"wp-image-9191\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image5-2-1024x315.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image5-2-300x92.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image5-2-768x236.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image5-2-370x114.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image5-2-270x83.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image5-2-740x227.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image5-2.png 1282w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Malicious activity label displayed in ANY.RUN\u2019s Linux sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>If you want more details about the specific malware, you can click on the links provided by the Tracker located next to the indicators. This will take you to the <a href=\"https:\/\/any.run\/malware-trends\/\" target=\"_blank\" rel=\"noreferrer noopener\">malware tracker<\/a>, where you can read a detailed description of the malware, including its origin, execution analysis, distribution methods, and much more.\u00a0<\/p>\n\n\n\n<!-- CTA Split START -->\n<div class=\"cta-split\">\n<div class=\"cta__split-left\">\n\n<!-- Image -->\n<img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/mcusercontent.com\/663b94f19348582a8dc323efe\/images\/0d88188b-3e89-2314-5a60-cb87e8077326.png\" alt=\"ANY.RUN cloud interactive sandbox interface\" class=\"cta__split-icon\" \/>\n<\/div>\n\n<div class=\"cta__split-right\">\n<div>\n\n<!-- Heading -->\n<h3 class=\"cta__split-heading\"><br>Learn to <span class=\"highlight\">analyze malware<\/span><\/h3>\n\n<!-- Text -->\n<p class=\"cta__split-text\">\nSee detailed guide to advanced malware and phishing analysis with ANY.RUN&#8217;s <span class=\"highlight\">Interactive Sandbox<\/span>.\n<br \/>\n<br \/>\n<b>Investigate any threat with ease<\/b>.\n<\/p>\n<\/div>\n<!-- CTA Link -->\n<a target=\"_blank\" rel=\"noopener\" id=\"article-banner-split\" href=\"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-in-a-sandbox\/\"><div class=\"cta__split-link\">See the guide<\/div><\/a>\n<\/div>\n<\/div>\n<!-- CTA Split END -->\n<!-- CTA Split Styles START -->\n<style>\n.cta-split {\noverflow: hidden;\nmargin: 3rem 0;\ndisplay: grid;\njustify-items: center;\nborder-radius: 0.5rem;\nwidth: 100%;\nmin-height: 25rem;\ngrid-template-columns: repeat(2, 1fr);\nborder: 1px solid rgba(75, 174, 227, 0.32);\nfont-family: 'Catamaran Bold';\n}\n\n.cta__split-left {\ndisplay: flex;\nalign-items: center;\njustify-content: center;\nheight: 100%;\nwidth: 100%;\nbackground-color: #161c59;\nbackground-position: center center;\nbackground: rgba(32, 168, 241, 0.1);\n}\n\n.cta__split-icon { \nwidth: 100%;\nheight: auto;\nobject-fit: contain;\nmax-width: 100%;\n}\n\n.cta__split-right {\ndisplay: flex;\nflex-direction: column;\njustify-content: space-between;\npadding: 2rem;\n}\n\n.cta__split-heading { font-size: 1.5rem; }\n\n.cta__split-text {\nmargin-top: 1rem;\nfont-family: Lato, Roboto, sans-serif;\n}\n\n.cta__split-link {\npadding: 0.5rem 1rem;\nfont-weight: 500;\ntext-decoration: none;\nborder-radius: 0.5rem;\ncolor: white;\nbackground-color: #1491D4;\ntext-align: center;\ntransition: all 0.2s ease-in;\ndisplay: block;\nz-index: 1000;\nposition: relative;\ncursor: pointer !important;\n}\n\n.cta__split-link:hover {\nbackground-color: #68CBFF;\ncolor: white;\ncursor: pointer;\n}\n\n.highlight { color: #ea2526;}\n\n\n\/* Mobile styles START *\/\n@media only screen and (max-width: 768px) {\n\n.cta-split {\ngrid-template-columns: 1fr;\nmin-height: auto;\n}\n\n.cta__split-left {\nheight: auto;\nmin-height: 10rem;\n}\n\n\n.cta__split-left, .cta__split-right {\nheight: auto;\n}\n\n.cta__split-heading { font-size: 1.2rem; }\n\n.cta__split-text { font-size: 1rem; }\n.cta__split-icon {\nmax-height: auto;\nobject-fit: cover;\n}\n\n}\n\/* Mobile styles END *\/\n<\/style>\n<!-- CTA Split Styles END -->\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Detailed malware processes<\/strong>&nbsp;<\/h3>\n\n\n\n<p>Next, over on the right side, you\u2019ll find the <a href=\"https:\/\/any.run\/cybersecurity-blog\/process-tree-analysis\/\" target=\"_blank\" rel=\"noreferrer noopener\">process tree<\/a>, showing all the parent PIDs and their child PIDs. This gives you a clear view of how malware behaves across processes. Want more details? Just click on any process, and you\u2019ll get a deep dive into its activity.\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"866\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagee-1-1024x866.png\" alt=\"\" class=\"wp-image-9192\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagee-1-1024x866.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagee-1-300x254.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagee-1-768x650.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagee-1-370x313.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagee-1-270x228.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagee-1-740x626.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagee-1.png 1284w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Process details displayed in ANY.RUN\u2019s Linux malware<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\"><strong>Network analysis details<\/strong>&nbsp;<\/h3>\n\n\n\n<p>Below the virtual machine, you\u2019ll also see a breakdown of all the <strong>network activity<\/strong>\u2014split into HTTP requests, connections, DNS requests, and <a href=\"https:\/\/any.run\/cybersecurity-blog\/new-threat-details-window\/\" target=\"_blank\" rel=\"noreferrer noopener\">detected threats<\/a>. This info is key for understanding the malware\u2019s behavior.&nbsp;&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"284\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image7-2-1024x284.png\" alt=\"\" class=\"wp-image-9194\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image7-2-1024x284.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image7-2-300x83.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image7-2-768x213.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image7-2-1536x426.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image7-2-370x103.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image7-2-270x75.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image7-2-740x205.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image7-2.png 1932w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>HTTP requests in ANY.RUN\u2019s sandbox<\/em><\/figcaption><\/figure><\/div>\n\n\n<p>For example, in our analysis session with Mirai malware, we can see how it uploads ELF files designed for specific system architectures.&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"626\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image8-3-1024x626.png\" alt=\"\" class=\"wp-image-9195\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image8-3-1024x626.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image8-3-300x183.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image8-3-768x469.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image8-3-1536x939.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image8-3-2048x1251.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image8-3-370x226.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image8-3-270x165.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image8-3-740x452.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Static discovery with ELF execution<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<p>By piecing together these insights, you get a comprehensive look at how the malware operates, making it easier to investigate and respond to potential threats.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Collection of IOCs and network reputation<\/strong>&nbsp;<\/h3>\n\n\n\n<p>For further analysis of the malware, you can easily gather all the IOCs (<a href=\"https:\/\/any.run\/cybersecurity-blog\/indicators-of-compromise\/\" target=\"_blank\" rel=\"noreferrer noopener\">Indicators of Compromise<\/a>) linked to the task by clicking the IOC button on the right side of the screen.\u00a0<\/p>\n\n\n\n<p>No need to jump between tabs\u2014everything you need is collected in one place, making it quicker and easier to manage.<\/p>\n\n\n\n<p>Plus, before each IOC, you\u2019ll find a network reputation indicator that lets you know whether the item is whitelisted or flagged as malicious, so you can prioritize it in your investigation.\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"733\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image9-3-1024x733.png\" alt=\"\" class=\"wp-image-9196\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image9-3-1024x733.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image9-3-300x215.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image9-3-768x550.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image9-3-1536x1099.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image9-3-370x265.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image9-3-270x193.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image9-3-740x530.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/image9-3.png 1568w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>IOCs gathered inside ANY.RUN\u2019s Linux sandbox<\/em>&nbsp;<\/figcaption><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\"><strong>MITRE ATT&amp;CK tactics and techniques<\/strong>&nbsp;<\/h3>\n\n\n\n<p>ANY.RUN\u2019s Linux sandbox also includes the <a href=\"https:\/\/any.run\/cybersecurity-blog\/mitre-attack\/\" target=\"_blank\" rel=\"noreferrer noopener\">MITRE ATT&amp;CK Matrix framework<\/a>, which is super helpful for understanding the techniques and tactics used in malware attacks.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Simply click the ATT&amp;CK button, and you\u2019ll be redirected to a new page showing all the techniques employed in the specific malware activity.\u00a0\u00a0<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"241\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagea-2-1024x241.png\" alt=\"\" class=\"wp-image-9197\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagea-2-1024x241.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagea-2-300x70.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagea-2-768x180.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagea-2-1536x361.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagea-2-2048x481.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagea-2-370x87.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagea-2-270x63.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagea-2-740x174.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>MITRE ATT&amp;CK tactics and techniques used for Mirai malware attack<\/em><\/figcaption><\/figure>\n\n\n\n<p>For example, in our Mirai malware analysis, one of the tactics used by the attackers was leveraging <strong>wget<\/strong> to download additional content\u2014highlighting just how attackers manipulate common tools for malicious purposes.\u00a0<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"717\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imageb-2-1024x717.png\" alt=\"\" class=\"wp-image-9201\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imageb-2-1024x717.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imageb-2-300x210.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imageb-2-768x537.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imageb-2-370x259.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imageb-2-270x189.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imageb-2-740x518.png 740w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imageb-2.png 1432w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>MITRE ATT&amp;CK Matrix framework techniques displayed in ANY.RUN\u2019s Linux sandbox<\/em>\u00a0<\/figcaption><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\"><strong>Process graph<\/strong>&nbsp;<\/h3>\n\n\n\n<p>ANY.RUN\u2019s Linux sandbox offers a <a href=\"https:\/\/any.run\/cybersecurity-blog\/process-graph\/\" target=\"_blank\" rel=\"noreferrer noopener\">process graph<\/a> that visually maps out the entire malware attack, showing every action the malware takes from start to finish. This graph gives you a clear, easy-to-understand view of the attack&#8217;s flow\u2014how it starts, what files are accessed, and what processes are executed.&nbsp;<\/p>\n\n\n\n<p>This feature is especially useful for more complex malware, where multiple actions happen simultaneously. You can zoom in on individual processes or view the bigger picture to get a complete understanding of how malware spreads and what it\u2019s trying to accomplish.&nbsp;<\/p>\n\n\n\n<p>Here is the process graph of our analysis, showing how Mirai infiltrates the system:&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"617\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagec-2-1024x617.png\" alt=\"\" class=\"wp-image-9202\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagec-2-1024x617.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagec-2-300x181.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagec-2-768x463.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagec-2-1536x926.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagec-2-2048x1235.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagec-2-370x223.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagec-2-270x163.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imagec-2-740x446.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Process graph of Mirai malware\u00a0<\/em>\u00a0<\/figcaption><\/figure><\/div>\n\n\n<h3 class=\"wp-block-heading\"><strong>Mirai malware analysis text report<\/strong>&nbsp;<\/h3>\n\n\n\n<p>During our interactive analysis of Mirai malware in the Linux sandbox, we saw just how detailed the investigation can get. From process trees to network interactions, the sandbox provides a deep dive into every aspect of the malware\u2019s behavior.&nbsp;<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"592\" src=\"\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imaged-1-1024x592.png\" alt=\"\" class=\"wp-image-9203\" srcset=\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imaged-1-1024x592.png 1024w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imaged-1-300x174.png 300w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imaged-1-768x444.png 768w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imaged-1-1536x889.png 1536w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imaged-1-2048x1185.png 2048w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imaged-1-370x214.png 370w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imaged-1-270x156.png 270w, https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2024\/10\/imaged-1-740x428.png 740w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\"><em>Mirai text report generated by ANY.RUN\u2019s Linux sandbox<\/em>\u00a0<\/figcaption><\/figure><\/div>\n\n\n<p>If you need to collect and review all this information later, you can easily do so by clicking the <strong>&#8220;Text Report&#8221;<\/strong> button in the upper right corner. This feature gathers all the critical details into one report, combining everything from the process graphs to the full scope of network activity for further analysis.&nbsp;&nbsp;<\/p>\n\n\n\n<p>Learn more: <a href=\"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-report\/\" target=\"_blank\" rel=\"noreferrer noopener\">Malware Analysis Report in One Click<\/a>\u00a0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why Use ANY.RUN&#8217;s Linux Sandbox?&nbsp;<\/h2>\n\n\n\n<p>ANY.RUN\u2019s Linux sandbox is built for both security professionals and beginners who need a reliable and fast environment to analyze malware targeting Linux systems.&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Real-time analysis<\/strong>: Watch malware activity live and react to the behavior instantly.&nbsp;<\/li>\n\n\n\n<li><strong>Full isolation<\/strong>: Safely inspect files and URLs without risking your main system.&nbsp;<\/li>\n\n\n\n<li><strong>Comprehensive threat detection<\/strong>: Handle all Linux malware types, including backdoors and crypto miners.&nbsp;<\/li>\n\n\n\n<li><strong>Easy setup<\/strong>: Start a session in just a few clicks\u2014no complex setup required.&nbsp;<\/li>\n\n\n\n<li><strong>Interactive environment<\/strong>: Interact directly with the malware and see its impact in real-time.&nbsp;<\/li>\n\n\n\n<li><strong>Centralized IOCs<\/strong>: All indicators of compromise are gathered in one spot for easy access.&nbsp;<\/li>\n\n\n\n<li><strong>Secure Cloud<\/strong>: Everything runs safely in the cloud\u2014no need for local software.&nbsp;<\/li>\n\n\n\n<li><strong>Detailed report<\/strong>: Receive a comprehensive analysis report after each session, including all critical findings.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Experience ANY.RUN&#8217;s Full Power with a Free Trial&nbsp;<\/h2>\n\n\n\n<p>Unlock the full potential of ANY.RUN with advanced features to elevate your malware analysis:\u00a0<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Windows 11\u00a0VM<\/li>\n\n\n\n<li><a href=\"https:\/\/any.run\/cybersecurity-blog\/privacy-features\/\" target=\"_blank\" rel=\"noreferrer noopener\">Private mode<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/any.run\/cybersecurity-blog\/anyrun-enterprise-plan\/\" target=\"_blank\" rel=\"noreferrer noopener\">Team collaboration tools<\/a>\u00a0<\/li>\n\n\n\n<li>API access and integration with <a href=\"https:\/\/any.run\/cybersecurity-blog\/splunk-integration\/\" target=\"_blank\" rel=\"noreferrer noopener\">Splunk<\/a> and <a href=\"https:\/\/any.run\/cybersecurity-blog\/opencti-integration\/\" target=\"_blank\" rel=\"noreferrer noopener\">OpenCTI<\/a><\/li>\n\n\n\n<li>And <a href=\"https:\/\/app.any.run\/plans\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=updated_linux&amp;utm_term=151024&amp;utm_content=linktoplans\" target=\"_blank\" rel=\"noreferrer noopener\">more<\/a><\/li>\n<\/ul>\n\n\n\n<p><a href=\"https:\/\/any.run\/demo\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=updated_linux&amp;utm_term=151024&amp;utm_content=linktodemo\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Request free trial \u2192<\/strong>\u00a0<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">About ANY.RUN&nbsp;&nbsp;&nbsp;<\/h2>\n\n\n\n<p>ANY.RUN helps more than 500,000 cybersecurity professionals worldwide. Our <a href=\"https:\/\/any.run\/?utm_source=anyrunblog&amp;utm_medium=article&amp;utm_campaign=updated_linux&amp;utm_term=151024&amp;utm_content=linktolanding\" target=\"_blank\" rel=\"noreferrer noopener\">interactive sandbox<\/a> simplifies malware analysis of threats that target both Windows and <a href=\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-cases\/\" target=\"_blank\" rel=\"noreferrer noopener\">Linux<\/a> systems. Our threat intelligence products, <a href=\"https:\/\/any.run\/cybersecurity-blog\/introducing-any-run-threat-intelligence-lookup\/\" target=\"_blank\" rel=\"noreferrer noopener\">TI Lookup<\/a>, <a href=\"https:\/\/any.run\/cybersecurity-blog\/yara-search\/\" target=\"_blank\" rel=\"noreferrer noopener\">YARA Search<\/a> and <a href=\"https:\/\/any.run\/cybersecurity-blog\/ti-feeds-integration\/\" target=\"_blank\" rel=\"noreferrer noopener\">Feeds<\/a>, help you find <a href=\"https:\/\/any.run\/cybersecurity-blog\/indicators-of-compromise\/\" target=\"_blank\" rel=\"noreferrer noopener\">IOCs<\/a> or files to learn more about the threats and respond to incidents faster.\u00a0\u00a0\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>At ANY.RUN, we\u2019re always working to improve our services, and this time, we\u2019ve focused on making our Linux sandbox even better. We&#8217;ve fine-tuned every detail to ensure it runs as smoothly and reliably as our Windows environment. \u00a0 From bug fixes to feature enhancements, our Linux sandbox is now more powerful and stable than ever, [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":9206,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[57,10,34,40],"class_list":["post-9182","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-service-updates","tag-anyrun","tag-cybersecurity","tag-malware-analysis","tag-malware-behavior"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.10 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>ANY.RUN Linux Sandbox for Fast and Secure Malware Analysis<\/title>\n<meta name=\"description\" content=\"Learn about the key features and capabilities of ANY.RUN&#039;s Linux malware sandbox and see analysis of a Mirai malware sample.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ANY.RUN\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/\"},\"author\":{\"name\":\"ANY.RUN\",\"@id\":\"https:\/\/any.run\/\"},\"headline\":\"ANY.RUN\u2019s Upgraded Linux Sandbox for Fast and Secure Malware Analysis\",\"datePublished\":\"2024-10-15T08:57:59+00:00\",\"dateModified\":\"2024-10-15T09:17:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/\"},\"wordCount\":1867,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"keywords\":[\"ANYRUN\",\"cybersecurity\",\"malware analysis\",\"malware behavior\"],\"articleSection\":[\"Service Updates\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/\",\"name\":\"ANY.RUN Linux Sandbox for Fast and Secure Malware Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/any.run\/\"},\"datePublished\":\"2024-10-15T08:57:59+00:00\",\"dateModified\":\"2024-10-15T09:17:23+00:00\",\"description\":\"Learn about the key features and capabilities of ANY.RUN's Linux malware sandbox and see analysis of a Mirai malware sample.\",\"breadcrumb\":{\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Service Updates\",\"item\":\"https:\/\/any.run\/cybersecurity-blog\/category\/service-updates\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"ANY.RUN\u2019s Upgraded Linux Sandbox for Fast and Secure Malware Analysis\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN&#039;s Cybersecurity Blog\",\"description\":\"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.\",\"publisher\":{\"@id\":\"https:\/\/any.run\/\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/any.run\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"url\":\"https:\/\/any.run\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"contentUrl\":\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg\",\"width\":1,\"height\":1,\"caption\":\"ANY.RUN\"},\"image\":{\"@id\":\"https:\/\/any.run\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/www.any.run\/\",\"https:\/\/twitter.com\/anyrun_app\",\"https:\/\/www.linkedin.com\/company\/30692044\",\"https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/any.run\/\",\"name\":\"ANY.RUN\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/any.run\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g\",\"caption\":\"ANY.RUN\"},\"url\":\"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ANY.RUN Linux Sandbox for Fast and Secure Malware Analysis","description":"Learn about the key features and capabilities of ANY.RUN's Linux malware sandbox and see analysis of a Mirai malware sample.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/","twitter_misc":{"Written by":"ANY.RUN","Est. reading time":"12 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/#article","isPartOf":{"@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/"},"author":{"name":"ANY.RUN","@id":"https:\/\/any.run\/"},"headline":"ANY.RUN\u2019s Upgraded Linux Sandbox for Fast and Secure Malware Analysis","datePublished":"2024-10-15T08:57:59+00:00","dateModified":"2024-10-15T09:17:23+00:00","mainEntityOfPage":{"@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/"},"wordCount":1867,"commentCount":0,"publisher":{"@id":"https:\/\/any.run\/"},"keywords":["ANYRUN","cybersecurity","malware analysis","malware behavior"],"articleSection":["Service Updates"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/","url":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/","name":"ANY.RUN Linux Sandbox for Fast and Secure Malware Analysis","isPartOf":{"@id":"https:\/\/any.run\/"},"datePublished":"2024-10-15T08:57:59+00:00","dateModified":"2024-10-15T09:17:23+00:00","description":"Learn about the key features and capabilities of ANY.RUN's Linux malware sandbox and see analysis of a Mirai malware sample.","breadcrumb":{"@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/any.run\/cybersecurity-blog\/linux-malware-analysis-sandbox\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/any.run\/cybersecurity-blog\/"},{"@type":"ListItem","position":2,"name":"Service Updates","item":"https:\/\/any.run\/cybersecurity-blog\/category\/service-updates\/"},{"@type":"ListItem","position":3,"name":"ANY.RUN\u2019s Upgraded Linux Sandbox for Fast and Secure Malware Analysis"}]},{"@type":"WebSite","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/","name":"ANY.RUN&#039;s Cybersecurity Blog","description":"Cybersecurity Blog covers topics for experienced professionals as well as for those new to it.","publisher":{"@id":"https:\/\/any.run\/"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/any.run\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/any.run\/","name":"ANY.RUN","url":"https:\/\/any.run\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","contentUrl":"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2020\/08\/ANYRUN-Icon.svg","width":1,"height":1,"caption":"ANY.RUN"},"image":{"@id":"https:\/\/any.run\/"},"sameAs":["https:\/\/www.facebook.com\/www.any.run\/","https:\/\/twitter.com\/anyrun_app","https:\/\/www.linkedin.com\/company\/30692044","https:\/\/www.youtube.com\/channel\/UCOgCPho7lzmH7m6fPNlukrQ"]},{"@type":"Person","@id":"https:\/\/any.run\/","name":"ANY.RUN","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/any.run\/","url":"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c4ce3a6c672056b4a8cd6b0110782215?s=96&d=mm&r=g","caption":"ANY.RUN"},"url":"https:\/\/any.run\/cybersecurity-blog\/author\/a-bespalova\/"}]}},"_links":{"self":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/9182"}],"collection":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/comments?post=9182"}],"version-history":[{"count":25,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/9182\/revisions"}],"predecessor-version":[{"id":9235,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/posts\/9182\/revisions\/9235"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media\/9206"}],"wp:attachment":[{"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/media?parent=9182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/categories?post=9182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/any.run\/cybersecurity-blog\/wp-json\/wp\/v2\/tags?post=9182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}