0x12DarkSandbox is free for everyone now
When I first launched 0x12DarkSandbox, the free tier existed mostly as a taste of the product: one scan, then you were expected to buy credits. That made sense for getting the first users in, but it…
When I first launched 0x12DarkSandbox, the free tier existed mostly as a taste of the product: one scan, then you were expected to buy credits. That made sense for getting the first users in, but it also meant the sandbox that actually matters, the one with real EDR telemetry and kernel level visibility, was gated behind a paywall from the start.
That changed this week. Every account now gets 3 full scans a day, for free, forever. Link:
How the platform works
Here’s a scan I ran to show it end to end:
https://0x12darksandbox.net/results/346
Submit a .exe, a .dll and the sample runs live against all four VMs in parallel. When it’s done, the results page gives you:
- Static analysis: Hashes, file identification, PE header breakdown, CAPA capabilities mapped to ATT&CK, YARA hits, FLOSS decoded strings, and flagged anomalies, all before the sample ever executes
- Alert list from Elastic EDR and Windows Defender
- Full event timeline: Every Sysmon event (process creation, network, registry, file, DNS) in one filterable list, correlated across all four VMs
- Process tree: Every process the sample spawned, with parent child relationships intact
- Registry changes: Every key created, modified, or deleted, with the process and source VM that did it
- Filesystem changes: Every file touched, with size and entropy per file so packed or encrypted payloads stand out
- Network capture: DNS queries, connections, HTTP requests, full packet stats, and the PCAP itself, all captured inside the isolated sandbox so nothing reaches the real internet
- Console output: Whatever the sample printed to stdout and stderr
- Call Chain: A merged timeline of Sysmon and Elastic EDR events in execution order, so you can follow what the payload actually did. This one’s paid, but free scans still show it with a locked count
What stays paid
- Raw shellcode submission
- BYOVD driver testing (that one burns a whole VM per run and needs a kernel panic recovery path)
- DTrace syscall capture
- Elastic api_call event stream
- PDF reports
- Multi engine AV scanning through Kleenscan
- API access
- Telegram bot
Those are the unique differences with the free and pro plan
Nothing about the privacy model changed. Binaries are still never shared with AV vendors or anyone else, and they’re deleted from the server after the job completes. Network isolation is still mandatory, your sample’s traffic never reaches the real internet
Try it:
📌 Follow me: 🐦 X | 💬 Discord Server | 📸 Instagram | Newsletter | YouTube
S12.