An open-source malware analysis framework that functions as a self-hosted alternative to VirusTotal.
Malice is an open-source malware analysis framework that scans files and hashes using multiple antivirus engines. It provides a self-hosted, scalable platform for security teams and researchers to analyze threats without relying on external services.
Security researchers, incident responders, and organizations needing private, scalable malware analysis capabilities.
It offers a free, privacy-focused alternative to commercial services like VirusTotal, with full control over data and infrastructure through Docker-based deployment.
VirusTotal Wanna Be - Now with 100% more Hipster
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports multiple antivirus and analysis engines through Docker containers, allowing customizable and extensible malware scanning pipelines, as shown in the plugin commands.
Can be self-hosted on-premises or in private clouds, ensuring sensitive malware data stays in-house without reliance on third-party services like VirusTotal.
Designed to scale from individual researchers to large enterprises, with a mission to serve any scale, as evidenced by the Kibana integration for result visualization.
Provides a Kibana-based UI for exploring and visualizing scan results, making it easy to analyze and report on malware findings.
Requires significant resources (~16GB disk, ~4GB RAM) and manual tuning, such as adjusting vm.max_map_count for Elasticsearch, as noted in Known Issues.
First run downloads all default plugins, which can take a long time, delaying immediate analysis for new deployments.
Heavily relies on Docker for all operations, adding administrative burden and making it unsuitable for environments without containerization support.
malice.io is an open-source alternative to the following products: