---
title: Install capa on Linux | Snap Store
description: Get the latest version of capa for Linux - Identify capabilities in executable
  files
url: https://snapcraft.io/capa
---

# capa

[Sid-Ali Teir (sidaliteir)](https://snapcraft.io/publisher/sidaliteir "View all snaps from Sid-Ali Teir (sidaliteir)")

* [Sid-Ali Teir (sidaliteir)](https://snapcraft.io/publisher/sidaliteir "View all snaps from Sid-Ali Teir (sidaliteir)")
* [Development](https://snapcraft.io/search?categories=development)
* [Security](https://snapcraft.io/search?categories=security)

latest/stable 10.0.0

Install latest/stable of capa

---

**Install using the command line**

```
sudo snap install capa
```

Don't have snapd? [Get set up for snaps](https://snapcraft.io/docs/installing-snapd).

---

### Package name

* capa

---

### License

* Apache-2.0

---

### Last updated

* 3 November 2026 - latest/stable
* 3 November 2026 - latest/candidate

---

### Websites

* [mandiant.github.io](https://mandiant.github.io/capa/ "https://mandiant.github.io/capa/")

---

### Contact

* [github.com/sidalit/capa-snap/issues](https://github.com/sidalit/capa-snap/issues "https://github.com/sidalit/capa-snap/issues")

---

### Source code

* [github.com/mandiant/capa](https://github.com/mandiant/capa "https://github.com/mandiant/capa")
* [github.com/sidalit/capa-snap](https://github.com/sidalit/capa-snap "https://github.com/sidalit/capa-snap")

---

### Report a bug

* [github.com/mandiant/capa/issues](https://github.com/mandiant/capa/issues "https://github.com/mandiant/capa/issues")
* [github.com/sidalit/capa-snap/issues](https://github.com/sidalit/capa-snap/issues "https://github.com/sidalit/capa-snap/issues")

---

##### Report a Snap Store violation

* [Report this Snap](https://snapcraft.io/capa#report-snap-modal)

---

* [Description](https://snapcraft.io/capa#tab-description)
* [Security](https://snapcraft.io/capa#tab-security)

#### Identify capabilities in executable files

capa is the FLARE team's tool to identify capabilities in executable
files. Run it against a PE, ELF or .NET module, or raw shellcode, and it
tells you what the program can do: for example, that it acts as a
backdoor, installs a service or communicates over HTTP. Results are
mapped to MITRE ATT&CK and the Malware Behavior Catalog. The standard
rule set and FLIRT library signatures are included.

**Examples**

```
capa suspicious.exe
capa -vv suspicious.exe
capa --json suspicious.exe > report.json
capa -f sc64 shellcode.bin
capa -r ~/capa-rules suspicious.exe
capa.show-features suspicious.exe
```

**Backends**

The vivisect and .NET backends, BinExport2 files, capa freeze files
and CAPE, DRAKVUF and VMRay sandbox reports are supported. The IDA,
Binary Ninja and Ghidra backends need those programs installed on the
host and are unavailable.

**File access**

capa can analyze files in your home directory. To analyze files on USB
drives and other removable media (/media, /mnt), run:

```
sudo snap connect capa:removable-media
```

---

## Install capa on your Linux distribution

Choose your Linux distribution to get detailed installation instructions. If yours is not shown, get more details on the [installing snapd documentation](https://snapcraft.io/docs/installing-snapd).

[### Arch Linux](https://snapcraft.io/install/capa/arch)

[### CentOS](https://snapcraft.io/install/capa/centos)

[### Debian](https://snapcraft.io/install/capa/debian)

[### elementary OS](https://snapcraft.io/install/capa/elementary)

[### Fedora](https://snapcraft.io/install/capa/fedora)

[### KDE Neon](https://snapcraft.io/install/capa/kde-neon)

[### Kubuntu](https://snapcraft.io/install/capa/kubuntu)

[### Manjaro](https://snapcraft.io/install/capa/manjaro)

[### Pop!\_OS](https://snapcraft.io/install/capa/pop)

[### openSUSE](https://snapcraft.io/install/capa/opensuse)

[### Red Hat Enterprise Linux](https://snapcraft.io/install/capa/rhel)

[### Ubuntu](https://snapcraft.io/install/capa/ubuntu)

[### Raspberry Pi](https://snapcraft.io/install/capa/raspbian)