ANY.RUN
Interactive online malware sandbox where analysts control the VM during detonation in real time.
Technical Architecture & Overview
ANY.RUN is a browser-based sandbox that lets an analyst interact with the guest machine while a sample runs, clicking through installers and driving browser-based threats. Reports cover process behavior graphs, network activity such as HTTP/S and DNS requests, IOCs, and MITRE ATT&CK mapping. Free Community accounts run public analyses on Windows, Linux, and Android guests, and paid tiers add private submissions, longer run times, more VM configurations, and team features.
Targeted Technical Use Cases
Detonating a phishing attachment or URL while steering the VM to confirm execution and collect IOCs.
Evaluation & Trade-offs
Core Strengths
- +Live interaction catches threats that need user action.
- +Public task library lets analysts reuse prior detonations.
- +MITRE ATT&CK mapping in reports, with JSON and MISP exports in paid plans.
Trade-Offs & Limitations
- -Free analyses are public, which leaks sample visibility.
- -The free Community plan limits runs to a 60-second VM timeout and 16 MB files.
Defensive Security Application
Confirming malicious attachments and URLs reported by users and harvesting indicators for blocking.
Frequently Asked Questions
What is ANY.RUN?→
ANY.RUN is a browser-based sandbox that lets an analyst interact with the guest machine while a sample runs, clicking through installers and driving browser-based threats. Reports cover process behavior graphs, network activity such as HTTP/S and DNS requests, IOCs, and MITRE ATT&CK mapping. Free Community accounts run public analyses on Windows, Linux, and Android guests, and paid tiers add private submissions, longer run times, more VM configurations, and team features.
What is ANY.RUN used for?→
Detonating a phishing attachment or URL while steering the VM to confirm execution and collect IOCs.
What are the strengths of ANY.RUN?→
- +Live interaction catches threats that need user action.
- +Public task library lets analysts reuse prior detonations.
- +MITRE ATT&CK mapping in reports, with JSON and MISP exports in paid plans.
What are the limitations of ANY.RUN?→
- +Free analyses are public, which leaks sample visibility.
- +The free Community plan limits runs to a 60-second VM timeout and 16 MB files.
How is ANY.RUN used defensively?→
Confirming malicious attachments and URLs reported by users and harvesting indicators for blocking.