Linux Analysis with REMnux
What is REMnux?
REMnux is a Linux distribution purpose-built for malware analysis. It includes 500+ tools pre-configured for reverse engineering and analysis workflows.
Installation Options
Option A: OVA Import (Recommended)
- Download REMnux OVA from docs.remnux.org
- Verify the SHA-256 hash from the download page
- Import into VirtualBox/VMware
- Default credentials: remnux/malware
- After first boot, run
remnux installto pull updates
Option B: Install on Existing Ubuntu
wget https://REMnux.org/remnux-cli
mv remnux-cli /usr/local/bin/remnux
chmod +x /usr/local/bin/remnux
sudo remnux install
Platform Notes
- REMnux is built for x86_64/amd64. On Apple Silicon, use x86 emulation in UTM (performance impact).
- Keep the VM off the internet with host-only networking -- but note that a host-only adapter still reaches your host. Keep shared folders, clipboard and drag-and-drop disabled, and use an Internal Network (
intnet) if you want no host-facing interface.
Key REMnux Tools
| Tool | Purpose |
|---|---|
| FLOSS | Obfuscated string extraction |
| CAPA | Capability detection |
| pefile | Python PE parsing |
| olevba | Office macro analysis |
| pdf-parser | PDF malware analysis |
| Yara | Pattern matching rules |
| Radare2 | Disassembler/debugger |
| INetSim | Network service simulation |
| Wireshark | Network capture analysis |
Network Setup
# Verify host-only networking
ip addr show
# Should show host-only interface (192.168.x.x)
# Start INetSim for network simulation
sudo inetsim
Snapshot
Take a clean snapshot after setup, before any analysis work.