Free public malware sandbox
Real malware labs.
Re-engineered.
Launch a real, isolated cybersecurity lab in your browser, investigate malware hands-on, switch the VM’s exit country live with RxGeo, and turn telemetry into analyst-ready intelligence.
Infrastructure online
EU hosted
RxGeo egress
No local setup
Isolated labs
RxLab Agent
RxGeo Egress
Atlas intelligence
Behavior stream
Signals observed in real time
Isolated VLAN
00:04
PROC
Process tree capturedParent-child relationship mapped
Observed
00:09
NET
Outbound signal detectedTraffic preserved for analysis
Correlated
00:11
GEO
Egress switched · JapanRxGeo · exit 198.51.100.33
Live
00:12
IOC
Artifacts indexedReport engine enriched
Ready
The platform
One secure workspace.
Every step of the investigation.
Launch a fully configured cybersecurity lab in under a minute. No setup, no snapshots, no virtualization—just analysis.
Built for real analysis
Purpose-built labs prepared for reverse engineering, malware research and penetration testing.
Isolation is the default
Per-lab VLAN segmentation behind pfSense keeps sessions monitored, separated and predictable.
Intelligence after execution
Atlas correlates observed behavior into actionable intelligence you can review, compare and share.
Egress, on demand
RxGeo Egress lets the agent switch the lab’s exit country in real time, from inside the VM.
Analysis flow
From sample to intelligence,
without the friction.
A clear, repeatable path keeps the interface out of your way and the investigation moving forward.
-
01
Ingest
Upload your sample and choose the lab that matches your objective.
-
02
Isolate
RxCloud provisions a segmented lab with browser-native access.
-
03
Observe
Execute, investigate and preserve system, artifact and network signals.
-
04
Correlate
Atlas maps behaviors, relationships, clusters and risk evolution.
-
05
Report
Retrieve PDF and JSON outputs with telemetry, context and IoCs.
Core capabilities
Enterprise-grade infrastructure.
Remarkably simple experience.
Every surface is designed to reduce operational noise while preserving the details researchers actually need.
Execution layer01 / LAB
ISO
Isolated by architecture,
Isolated by architecture,
not by assumption.
Distributed Master, Node2 and Node3 capacity with segmented environments and monitored network activity.
Access layer02 / WEB
HTML5
Your lab lives in the browser.
Open, authenticate and work through Apache Guacamole. No client, VPN or local toolchain required.
Telemetry layer03 / OBS
CORE.LOG
Capture what matters.
RxLab Agent observes filesystem, registry and network activity, with low-level antivirus telemetry hooks inside PentestLab sessions.
Intelligence layer04 / ATLAS
GRAPH
Behavior becomes a map.
Explore families, relationships, execution chains and confidence-weighted signals across public and private intelligence views.
Explore RxCloud Atlas ↗Reporting layer05 / EXPORT
PDF + JSON
Evidence ready for your next decision.
Generate analyst-ready PDF reports and structured JSON evidence, ready for reporting, automation or AI-assisted analysis.
Agent technology
RxGeo Egress.
Switch the lab’s exit, live.
Inside the VM, the agent changes geographic egress in real time. Observe how a sample behaves when the public exit moves across countries, without leaving the session.
In-VM · real time
One session. Many exits.
Supported lab traffic leaves through the country you select. The agent applies the switch while the analysis keeps running — no reboot, no new VM, no local client.
-
01
Live switch
Change the exit IP during the session, directly from the lab.
-
02
Country mesh
Multiple exits, available inside the Windows, Linux, Kali and Android labs.
-
03
Built for research
Watch geo-dependent malware, regional infrastructure and locale-specific signals.
Research egress for the laboratory. Not a VPN, anonymizer or general-purpose proxy. Platform control traffic stays on its own path.
Active
Active exit
FR
France · Paris
203.0.113.18
Supported traffic routed
- LEASEFrance exit armedReady
Independent by design
Built by an independent malware researcher.
Made for the people doing the work.
RxCloud began in Alsace, France, with one goal: build the kind of cloud laboratory its founder always wanted to use—fast, isolated, practical and accessible.
“No investor-driven roadmap. No artificial paywall. Just a serious platform focused on useful, accessible malware research.”
Questions / Answers
Everything you need
before your first session.
RxCloud is a free, open malware sandbox accessible through your browser. It provides isolated Windows, Linux, Kali and Android environments for defensive research, reverse engineering, antivirus testing and security education.
Create and verify your account, request an available lab profile, join the provisioned VM through HTML5, execute your analysis and end the session when finished. RxCloud then processes telemetry, private reports, artifacts and Atlas intelligence.
Yes. RxCloud is community-oriented and has no premium tier or hidden paywall. Shared resources use 60-minute sessions and a queue so access remains fair and predictable for everyone.
Core services and user data are operated from France. Additional compute capacity runs on OVHcloud infrastructure in France and Germany, with Node3 dedicated to Android labs in Gravelines.
The platform is intended exclusively for research, education and defensive cybersecurity work. It is not a VPN, proxy, hosting platform or environment for offensive activity against real-world targets.
RxGeo Egress is an agent capability inside the lab VM. It switches the geographic exit of supported session traffic in real time, across multiple countries, so you can observe region-specific behavior without starting a new machine. It is a research control for the laboratory — not a VPN, anonymizer or general-purpose proxy — and platform control-plane traffic does not follow that path.
Secure transmission
Let’s talk about
RxCloud CyberLab.
Questions, feedback, partnerships or research collaboration — open a direct channel with the project.
TRANSMISSION / NEW
Ready when you are
Turn the next unknown sample
Start analyzing