We’re skipping our usual weekly update to bring you something even bigger: the release of a highly anticipated feature, Sandbox Network Geolocation. Many of you have been asking for this, and we’re thrilled to finally make it available!
This new feature lets you choose a VPN location under the Internet Access configuration option. It allows you to detonate samples using network exit points from supported regions, adding a powerful new layer to your analysis.
Integration with APIs and profiles is currently under development, allowing you to automate region selection in your workflows. Stay tuned for more updates soon!
What Is Network Geolocation
Network Geolocation lets you control the network exit region for network traffic coming from the malware analysis VMs, separately from where the sandbox is hosted.
This feature allows you to:
- Run malware that is designed to execute only in certain regions or behaves differently depending on location
- Access websites that are restricted by region
How to Use It
In the Internet Access section of your analysis configuration option, you will now see a VPN option. You can choose from a list of supported regions to route your analysis traffic by selecting either Continent or Country.
Note: We currently support a limited number of regions. However, we are actively working to expand this list and will continue adding more in the future.
Why It Matters
Today’s malware often identifies its region before executing certain functions. With Network Geolocation, you can uncover behavior that might otherwise remain hidden, gain access to region-specific infrastructure, and fully understand how different threats operate in various locations.
This feature is especially useful for:
- Investigating geo-targeted malware campaigns
- Accessing command and control servers that may be restricted by region
- Understanding the infrastructure of threat actors linked to specific locations
Available Now
Network Geolocation is now live in the Triage web interface. We encourage you to explore how region-based analysis can boost your malware investigations!
We’d love to hear your thoughts and suggestions. Let us know which regions you’d like us to support next. Happy exploring!
If you have any feedback, questions, or issues about Triage feel free to reach out to us any time - we do our best to respond to all feedback but even if we can’t get back to you straight away your files will go into our list of things to review and help us prioritize tasks.
You can find us directly through the website, or using the Feedback option on an analysis report page.
Not signed up yet? Head over to tria.ge to register for a free account.