Any.Run VS Firejail

Https://app.any.run/ should be enough for most of the cases. If you have packed/encrypted sample (like EMP.dll from Empress), you can't do anything. Source: 11 months ago

If you open it on https://app.any.run it will show you the outbound connections it makes. If you're responsible for such things, you could then block this on your web proxy/firewall/whatever. Source: 12 months ago

Hello! Try this https://app.any.run/. Source: about 1 year ago

Does anyone have an account at app.any.run to have more analysis about their file? Source: about 1 year ago

App.any.run was probably the most useful thing in getting to understand how malware works, its basically an sandbox where it shows you all actions, changes, modifications and network connections done by any executable, including any malware, you can begin by analyzing this piece of Redline Stealer. Source: over 1 year ago

Firejail can also be a useful option, though no good if you're on Mac https://firejail.wordpress.com/ Uses the same Linux primitives as docker etc, but can be a bit more ergonomic for this use case. - Source: Hacker News / 8 months ago

You can find more info on its world-press website: https://firejail.wordpress.com/. Source: about 1 year ago

Try running your Wine app through something like Firejail. Source: about 1 year ago

Firejail is a program that helps to improve the security of your system by creating a restricted environment for running non-trusted applications. It does this using Linux namespaces, seccomp-bpf, and Linux capabilities, and is easy to use thanks to its setuid sandbox feature. Source: over 1 year ago

Sorry, missed "avoid having libs on local machie". Someone mentioned chroot. That's good! Also maybe firejail. I also use x11-docker. Source: over 1 year ago