A VM orchestration for malware analysis. Given a VirtualBox VM, a dashboard on the host, and an agent in the guest, a sample can be uploaded to the VM and its telemetry monitored live and categorized on the host.

The dashboard controls the analysis VM, including start, stop, and restoring a selected snapshot.

Telemetry from the guest agent is shown in a process tree, a process timeline, local and external network traffic views, and a file monitor panel.

ZBS Labs Sandbox was developed as a PoC to add certain features to future applications and is not distributed.