Recorded Future – Malware Intelligence

Recorded Future Malware Intelligence is a malware analysis and hunting capability delivered inside the Recorded Future Threat Intelligence module, built on the cloud sandbox that began as Hatching Triage and is now called Recorded Future Sandbox. Analysts submit files or URLs by hand or through an API and watch detonation in a customizable environment with live control of the virtual machine, while the engine extracts malware configurations, applies family tags and produces static and behavioral reports for Windows, Linux, macOS and Android samples. Each sample is linked to the Recorded Future Intelligence Graph, so lineage, related infrastructure and threat actor context sit next to the technical findings. Natural language malware hunting lets junior analysts search command lines, registry keys, IOCs and PE imports in plain English, Auto YARA drafts detection rules that are checked against known good file sets, and Malware Alerts notify teams when new variants match a custom rule. Results can be pushed into existing tools through APIs, playbook alerts and integrations such as Microsoft Sentinel. The sandbox is hosted in the EU by default, with US and Asia-Pacific regions available on request. Sandbox access and Malware Intelligence come with the Threat Intelligence module, subject to daily submission limits, and Recorded Future is now owned by Mastercard.