CAPEv2
💥 Exploitation · Python
CAPEv2 (Config And Payload Extraction) is an open-source malware analysis sandbox forked from Cuckoo. It automates the process of detonating malware samples in instrumented virtual machines and extracting behavioral data. CAPEv2 captures API calls, network traffic, dropped files, registry changes, and process trees. Its signature feature is automated payload and configuration extraction from 200+ malware families (Emotet, TrickBot, QakBot, Cobalt Strike, etc.), recovering C2 URLs, encryption keys, and injected payloads. It supports Windows, Linux, and Android analysis VMs with YARA scanning, Suricata network detection, and detailed HTML/JSON reporting.
Installation
$ git clone https://github.com/kevoreilly/CAPEv2.git && cd CAPEv2 && bash installer/cape2.shUse Cases
- Automated malware detonation and behavior recording
- Extracting C2 configurations from malware families
- Generating IOCs from malware network activity
- Building malware analysis pipelines with API integration
Tags
Details
- Category
- 💥 Exploitation
- Language
- Python
- Repository
- kevoreilly/CAPEv2
- Platforms
- 🐧linux
Links
Community Reviews
Alternatives & Comparisons
Velociraptor
GoEndpoint visibility and collection tool. Hunt for artifacts across thousands of endpoints simultaneously.
Compare CAPEv2 vs VelociraptorMore in Exploitation
Metasploit Framework
RubyThe world's most used penetration testing framework. Exploit development, payload delivery, post-exploitation.
BloodHound
GoActive Directory attack path mapping. Visualizes privilege escalation paths using graph theory.
Impacket
PythonCollection of Python classes for working with network protocols. Essential for Windows/AD pentesting.
CrackMapExec
PythonSwiss army knife for pentesting Active Directory. SMB, LDAP, MSSQL, WinRM enumeration and exploitation.
Evil-WinRM
RubyUltimate WinRM shell for pentesting. Upload/download, in-memory PowerShell, DLL injection, pass-the-hash.
Covenant
C#.NET C2 framework. Collaborative, web-based interface for red team operations and implant management.