An automated, cross-platform security analysis engine for safely detonating suspicious files, binaries, and applications.
🎬 Watch the Project Demo

💻 Tech Stack

Core Programming Languages, Core Systems

Platform Support & Hardware Architecture

Low-Level Infrastructure & Performance

Cybersecurity & Offensive Auditing

DevOps & Build Tools

Artificial Intelligence & Quantum

Cloud Providers

📖 What is this?

SandB0x-Xtract0r provides a unified environment to execute payloads across PC, mobile, and cloud environments. While the payload executes, the system captures runtime telemetry, network traces, and memory dumps, which are then synthesized into structured threat reports by an integrated multi-LLM bot.

💡 Simplified Summary

Imagine you find a mystery package on your porch, but you aren't sure if it's a cool toy or a messy glitter bomb. Instead of opening it in your living room, you put the package inside a thick, clear plastic box in your backyard. You use robotic arms to open it while cameras record exactly what happens. If it explodes, the mess stays completely trapped, and your house is safe!

SandB0x-Xtract0r is that clear plastic box for computer files. It puts a mystery file inside a fake, trapped computer, watches everything it does, takes notes, and uses a smart AI robot to read those notes and tell you exactly how dangerous the file was.

✨ Core Features

• Dynamic Detonation: Safely executes malware, scripts, and applications targeting Windows, Linux, Android, iOS, and cloud containers.
• Deep Telemetry Extraction: Monitors and captures real-time system calls (via eBPF), network traffic (PCAPs), filesystem modifications, and RAM artifacts (memory dumping).
• AI-Powered Synthesis: Feeds raw execution telemetry into a multi-LLM gateway (utilizing Gemini, Claude, and OpenAI) to translate complex hexadecimal and machine-level behaviors into readable, MITRE ATT&CK-mapped threat intelligence reports.
• Automated Orchestration: Uses a Celery and Redis task queue to manage multiple sandbox environments concurrently without bottlenecking the main API.

Before you can build your safe plastic box, you need the right tools:

• 🐧 A Linux Computer: The creator says it is best to use a computer with a Linux operating system. Linux has special hardware powers (called KVM) to make the testing run super fast!
• 🐳 Docker & Docker Compose: These are like magical shipping containers. They hold all the different parts of the project safely inside so they don't get mixed up with your computer's normal files.

📥 Step 1: Bring the Blueprints to Your Computer

First, we need to download the project folders so your computer knows what to build.

1. Open your computer's command line (the black screen where you type commands).
2. Type a git clone command to download the Sandb0x-Xtract0r project straight from GitHub.
3. Next, open the folder you just downloaded by typing cd Sandb0x-Xtract0r.

🔑 Step 2: Give the Robots Their Secret Keys

To make the tool super smart, you have to wake up the AI robot brains! 🧠

1. Look in the folder for a file named .env.example.
2. Inside this file, there are blank spaces. You need to paste your secret passwords (called API keys) for different AI models like Google Gemini, Anthropic Claude, and OpenAI ChatGPT.

The tool needs some extra little helper programs to work perfectly.

1. Look at the packages.txt file. It says you need to install a special helper called libmagic1.
2. Look at the requirements.txt file. This tells your computer to install Python helpers, like pdfkit to make reading the final reports easy, and celery to manage heavy lifting!

🏗️ Step 4: Build the Safe Testing Rooms

Now you tell Docker to build all the special rooms for testing! 🏠

• The project uses a big instruction manual called docker-compose.yml.
• When you run it, Docker will magically create a few cool things:
  • 👨‍✈️ An Orchestrator: The boss that tells everyone what to do.
  • ✉️ Redis: The fast messenger pigeon that carries notes.
  • 🏋️ A Celery Worker: The strong helper doing the heavy lifting and running the tests.
  • 📱 An Android Sandbox (Redroid): A fake phone space to safely test mobile apps.

🚀 Step 5: Test a Mystery File!

Once everything is built and running smoothly, you are ready to use it! 🎉

1. Submit a suspicious file into the system.
2. The system traps the file in the safe box and watches everything it tries to do. 👀
3. The smart AI robots read the notes and write a super detailed report telling you exactly how dangerous the file really was! 🛡️

🎯 What problems does this solve?

• Platform Fragmentation: Security researchers usually need entirely different toolchains to analyze an Android APK versus a Windows executable. SandB0x-Xtract0r centralizes all analysis into one pipeline.
• Information Overload: Sifting through thousands of lines of raw system calls and unreadable memory dumps is exhausting. The multi-LLM integration does the heavy lifting, instantly surfacing the most critical threats.
• Infrastructure Management: Automatically spins up, resets, and tears down virtualization environments (QEMU, Redroid, Corellium) for every single run, ensuring a clean slate and preventing cross-contamination.

💻 Installation & Setup

Prerequisites: Docker, Docker Compose, and a Linux host (recommended for KVM/hardware acceleration).

1. Clone the repository

git clone [https://github.com/darnellwashingtonjr94-art/SandB0x-Xtract0r.git](https://github.com/darnellwashingtonjr94-art/SandB0x-Xtract0r.git)
cd SandB0x-Xtract0r

___

## SandB0x-Xtract0r ##
├── [ 📄 ] .env.example
├── [ 📁 ] .github/
│   ├── [ 📁 ] ISSUE_TEMPLATE/
│   └── [ 📁 ] workflows/
├── [ 🚫 ] .gitignore
├── [ 📁 ] config/
├── [ 🐳 ] docker-compose.yml
├── [ 📚 ] docs/
├── [ 🖥️ ] frontend/
├── [ 🖼️ ] IMG_1220.png
├── [ ⚖️ ] LICENSE
├── [ 📖 ] README.md
├── [ 📦 ] requirements.txt
├── [ 🛠️ ] scripts/
├── [ 📁 ] src/
│   ├── [ 🔌 ] api/
│   ├── [ 🔍 ] extractors/
│   ├── [ 🧠 ] llm_bot/
│   ├── [ ⚙️ ] orchestrator/
│   ├── [ 📦 ] sandboxes/
│   ├── [ 🤖 ] bot.py
│   └── [ 🚀 ] main.py
├── [ 💾 ] storage/
└── [ 🧪 ] tests/