CAPEsolo

Python GUI to run capemon in standalone VM. Provides a subset of CAPE (Configuration And Payload Extraction) processing and results.

Create a Windows 10 VM that's suitable for running malware.
- Use the CAPEv2 guest guide for configuration details.
- https://capev2.readthedocs.io/en/latest/installation/guest/index.html
Install Python in VM, tested on 64-bit Python versions 3.11 and 3.12, and add Python to path.
Download and install both Microsoft Visual C++ Redistributables:
- https://aka.ms/vs/17/release/vc_redist.x86.exe
- https://aka.ms/vs/17/release/vc_redist.x64.exe
Install CAPEsolo.
- pip install CAPEsolo
Snapshot your VM.

Quick Start

Open an administrator command window.
Type capesolo to run.

Alternatively, create a shortcut to CAPEsolo.exe, which will be in the Scripts subdirectory of same location as your python.exe file.

Under Advanced, check 'Run as administrator'
An icon file is available in the CAPEsolo install folder under site-packages.

Analysis results are found in C:\Users\Public\CAPEsolo\analysis.

Can be configured in C:\Users\Public\CAPEsolo\cfg.ini
Settings there override the packaged defaults in python-path\site-packages\CAPEsolo\cfg.ini, and survive pip install --upgrade CAPEsolo, which overwrites the packaged copy.
Only include the keys you want to change; the rest fall back to the packaged defaults.

Revert the VM after each analysis.

Download Samples by Hash

The Start panel can fetch a sample by MD5/SHA1/SHA256 from VirusTotal or MalwareBazaar and use it as the analysis target. The source is auto-selected (VirusTotal first, then MalwareBazaar; MalwareBazaar requires a SHA256), based on which keys are configured.
Turn it on in cfg.ini (or via the Settings button): under [download] set enabled = true. directory sets where samples are saved (defaults to the user's Desktop).
API keys - where to get them:
- VirusTotal: file downloads require a VirusTotal Enterprise / Intelligence API key. The free community key can look up reports but cannot download files.
- MalwareBazaar: a free abuse.ch Auth-Key (create an account at auth.abuse.ch).
API keys are stored ENCRYPTED, never in plaintext on the VM. You produce the encrypted blob OFF the VM with tools/encrypt_api_key.py and paste it into cfg.ini.
tools/encrypt_api_key.py ships in the CAPEsolo source repository under tools/. Run it on a trusted host (NOT the analysis VM); it only needs pip install cryptography.
- python tools/encrypt_api_key.py
- It prompts (hidden) for the API key and a password, and prints an encrypted blob.
- Encrypt every provider you use with the SAME password, so one prompt unlocks both.
Install the blob in the guest by either:
- pasting it into cfg.ini as api_key_enc under [virustotal] and/or [malwarebazaar], or
- setting the CAPESOLO_VT_APIKEY_ENC / CAPESOLO_MB_APIKEY_ENC environment variables (env vars override cfg.ini).
When downloads are enabled, CAPEsolo prompts once at startup for the password and decrypts the key in memory only; the plaintext key never touches the VM's disk. Enter the password, then snapshot the VM so it is ready on every revert.

MCP Server

CAPEsolo includes an MCP server entrypoint for programmatic analysis workflows.
Start it over stdio with CAPEsolo-mcp, or serve it over HTTP to reach it from the host.
See mcp_server.md for transports, cfg.ini configuration, the full tool list, and examples.

Interactive Debugger

See interactive_debugger.md for the GUI debugger, and mcp_server.md for the MCP equivalent.

Headless Single-Run CLI

CAPEsolo supports a non-MCP single-run mode that reuses the same backend job runner as the MCP server.
Run one analysis and exit:
- CAPEsolo --headless-analyze "C:\path\sample.exe"
Optional flags:
- --package <name>
- --options "key=value,key2=value2"
- --timeout <seconds>
- --enforce-timeout
- --headless-json
- --headless-html-report

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

capesolo-0.5.30.tar.gz (7.5 MB view details)

Uploaded Aug 12, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

capesolo-0.5.30-py3-none-any.whl (7.8 MB view details)

Uploaded Aug 12, 2026 Python 3

File details

Details for the file capesolo-0.5.30.tar.gz.

File metadata

Download URL: capesolo-0.5.30.tar.gz
Upload date: Aug 12, 2026
Size: 7.5 MB
Tags: Source
Uploaded using Trusted Publishing? No
Uploaded via: twine/6.2.0 CPython/3.11.9

File hashes

Hashes for capesolo-0.5.30.tar.gz
Algorithm	Hash digest
SHA256	`a586839284bb5cd0b46c9d488bea15071621d6f6ece6003296ddc6d2c302d215`
MD5	`1fa7117495a18cc250c59a398736fc15`
BLAKE2b-256	`31d239c98492cded4878e3a8847e9af1c7904cf9f6e48e07a94e16c15ae80e96`

See more details on using hashes here.

File details

Details for the file capesolo-0.5.30-py3-none-any.whl.

File metadata

Download URL: capesolo-0.5.30-py3-none-any.whl
Upload date: Aug 12, 2026
Size: 7.8 MB
Tags: Python 3
Uploaded using Trusted Publishing? No
Uploaded via: twine/6.2.0 CPython/3.11.9

File hashes

Hashes for capesolo-0.5.30-py3-none-any.whl
Algorithm	Hash digest
SHA256	`3b96936337042ecdec0eab842203339f39800748d526dc26171e7f8210efe5e5`
MD5	`60e9c7fb52a68998a90efbfdffa26c56`
BLAKE2b-256	`8c8c40da85c9f4b1e1c14b06913816081c1e21895c3aab8cdf0f1d55c4ac997b`