ANY.RUN

What it is

ANY.RUN is a commercial interactive malware analysis sandbox (any.run). Analysts detonate suspicious files and URLs in instrumented virtual machines and can interact with the session live, rather than waiting for a fully automated report alone.

What it helps with

- Triaging malware and phishing samples with live keyboard and mouse interaction in the sandbox.
- Observing process trees, network activity and behavioural indicators during detonation.
- Generating analyst-oriented reports and exporting artefacts on supported plans.
- Covering Windows, Linux and Android environments on the free Community tier, with wider OS options on paid plans.
- Keeping analyses private and raising timeouts or file-size limits on Hunter and Enterprise Suite.
- Supporting SOC and MSSP workflows with team features, SSO and API access on Enterprise.

Who it's for

Malware analysts, SOC analysts and researchers who need an interactive online sandbox for sample triage, as a peer to other malware analysis platforms, with a free starting tier.

Worth knowing

ANY.RUN offers a free Community plan (limited timeout, public analyses and feature set) plus paid Hunter and Enterprise Suite subscriptions billed yearly with contact-based pricing on the official plans page. Official site: any.run. Brand mark from any.run/img/logo.svg. Confirm current plan limits and commercial terms on any.run/plans before purchase.