BaileysSandbox: An AI-Powered Malware Analysis Sandbox
Researchers: {VXRL Team}
Detonating malware so you don’t have to.
BaileysSandbox is our internal malware analysis platform built for the VX Research Team. Submit suspicious files or URLs, detonate them inside isolated VirtualBox VMs, and get a complete behavioral analysis — all from the browser. When the dust settles, a local LLM reviews every artifact and writes a threat assessment.
Why We Built It
Commercial sandboxes are expensive and cloud-based ones send samples to third parties — neither is ideal for our research workflow. BaileysSandbox runs entirely on our own infrastructure, so samples never leave the lab. We built it to give the team a fast, flexible tool for understanding what malware actually does when it runs.
The platform combines:
- Live VM interaction via noVNC (watch malware run in real time)
- Docker-isolated static analysis (PE parsing, YARA scanning — malware never touches your host)
- Behavioral monitoring (process, file, registry, network events captured by an in-guest agent)
- Network traffic capture (HTTP, DNS, TLS via tshark + Suricata IDS)
- AI-powered threat assessment (local Ollama LLM analyzes all findings)
Live View: Watch Malware in Action
When you submit a sample, BaileysSandbox spins up a fresh VirtualBox linked clone, deploys your file, and executes it. You get a live noVNC desktop right in the browser — full mouse and keyboard access to the Windows VM while it runs.
Alongside the desktop, real-time panels show processes spawning, network connections being made, and IDS alerts firing as they happen.
The Live View tab shows a Windows 10 VM executing a sample. The left panel displays the noVNC desktop, while the right panels stream live process activity and network traffic (HTTP requests, DNS queries, TLS handshakes).
Static Analysis: Know What You’re Dealing With
Before the sample even runs, BaileysSandbox performs static analysis inside a Docker container — the malware is never extracted on your host filesystem. The static analyzer parses PE headers, identifies suspicious API imports, calculates section entropy, detects packers, and runs 91 YARA rules across 9 categories.
The Static Analysis tab breaks down the PE structure: architecture, entry point, section entropy, imported DLLs with suspicious APIs highlighted, and extracted strings. Notice the suspicious string C:\malware\persist.exe flagged in the output.
Guest Recon: Full System Fingerprint
The in-guest monitoring agent doesn’t just watch for malware behavior — it also performs a full system reconnaissance of the sandbox environment. This helps analysts understand the execution context and identify any sandbox-aware behavior.
The Recon tab shows 31 events across 9 categories: OS information (Windows 10, 64-bit, 2048MB RAM), network adapter configuration, active connections, routing table, firewall status, and more. Each category is collapsible for easy navigation.
Network Analysis: Every Connection Captured
All network traffic from the VM is captured via VirtualBox NIC tracing. tshark parses the PCAP into structured HTTP requests, DNS queries, and TLS handshakes. Suricata runs IDS rules against the capture to flag known-malicious patterns.
The same traffic view is available both during live analysis and after completion.
The Network tab displays parsed HTTP traffic showing requests to Windows Update servers, test sites, Google, and Microsoft services. Each connection shows method, host, path, status code, and content type.
AI Threat Assessment: Let the LLM Do the Heavy Lifting
After all artifacts are collected — process events, file activity, registry changes, network traffic, IOCs, MITRE ATT&CK mappings, YARA matches — BaileysSandbox feeds everything to a local Ollama LLM for analysis.
The AI produces a structured threat assessment covering: executive summary, malware classification, behavioral analysis, network analysis, persistence mechanisms, IOC summary, recommendations, and a final risk rating.
You can also provide additional context or instructions for the AI to follow — for example, telling it to ignore known-benign IOCs or focus on specific behaviors.
The AI Analysis tab shows a completed assessment by gemma3:27b. The LLM identified the sample’s risk level, summarized key IOCs, provided detection recommendations, and assigned a Medium risk rating with justification. Analysts can rerun with additional instructions.
Architecture at a Glance
BaileysSandbox is a monorepo with three packages:
The analysis flow:
- Submit a file or URL
- Static analysis runs in a Docker container (PE parsing, YARA, string extraction)
- A linked clone is created from the base VM snapshot
- The guest agent auto-starts and begins monitoring (WMI events, file watchers, registry polling)
- The sample is deployed and executed inside the VM
- Events stream in real time via Socket.io (process, file, registry, network)
- Traffic capture runs continuously (VirtualBox NIC trace + tshark parsing + Suricata IDS)
- On completion: IOC extraction, MITRE ATT&CK mapping, threat scoring (0–100)
- The AI analyzer reviews all artifacts and produces a structured assessment
- Everything is visible in a single dashboard page
Conclusion
BaileysSandbox was built to give our VX Research Team a self-hosted, no-compromises malware analysis environment. No sample uploads to third-party clouds, no per-scan fees, no waiting — just spin up a VM, detonate, and get results.
The platform combines the interactivity of a manual analysis workflow with the automation of a modern sandbox pipeline — live VM access, structured behavioral data, network forensics, and AI-driven insights, all in one place.
There’s still plenty of room to grow — Additioanl malware analysis tool like Capa, improve Yara rules, Mitre Att&ck Analysis, Linux guest agents, memory forensics, multi-model AI comparison etc … — but the foundation is solid and already serving the team’s day-to-day research needs.
