REMnux

What REMnux Is and Why Analysts Use It

• REMnux is a Ubuntu-based Linux distribution maintained by Lenny Zeltser that bundles hundreds of malware analysis tools into a single VM or Docker image. It is the standard toolkit for SOC malware triage and reverse engineering.
• MITRE ATT&CK maps malware analysis to supporting T1204 (User Execution) detection — understanding what a file does informs response decisions.
• The value of REMnux is that it eliminates tool setup time. Instead of spending hours installing Python packages, reverse engineering frameworks, and analysis utilities, an analyst spins up a REMnux VM and has immediate access to everything they need for static analysis, dynamic analysis, memory forensics, and network simulation.
• It is typically used alongside a Windows analysis sandbox (like FLARE VM) — REMnux handles Linux malware, network analysis, and tools while the Windows VM handles PE analysis.

Installation and Setup

System Requirements

Installation Methods

# Method 1 — Download VM image (recommended)
# Download from: https://docs.remnux.org/install/get-the-appliance
# Import into VirtualBox or VMware

# Method 2 — Install on existing Ubuntu
wget https://remnux.org/install-ubuntu.sh
chmod +x install-ubuntu.sh
sudo ./install-ubuntu.sh

# Method 3 — Docker
docker pull remnux/remnux-docker
docker run -it remnux/remnux-docker

# Method 4 — SaltStack-based install (for customization)
sudo apt update && sudo apt install -y salt-minion
sudo wget -O /tmp/remnux.sls https://remnux.org/remnux.sls
sudo salt-call --local state.apply remnux.sls

First Boot — Post-Installation Tasks

# Update tool packages
sudo remnux update

# Verify installation — list all installed tools
remnux tools

# Set up network simulation tools (for safe malware execution)
sudo remnux netsim-setup

Tool Categories on REMnux

Static Analysis Tools

Dynamic Analysis Tools (Safe Execution)

Memory Forensics Tools

YARA and Signature Tools

Network Analysis Tools

Common REMnux Workflows

Workflow 1 — Static Triage of a Suspicious PE

# 1. Identify file type
file suspicious.exe

# 2. Compute hashes
sha256sum suspicious.exe
md5sum suspicious.exe

# 3. Extract strings (including obfuscated)
strings suspicious.exe | grep -i "http"
floss suspicious.exe | grep -iE "https?://|C:\\"

# 4. Check for packers
diec suspicious.exe

# 5. Analyze PE structure
readpe suspicious.exe | grep -A 10 "Sections"

# 6. Identify capabilities
capa suspicious.exe

# 7. Check against VirusTotal (requires API key)
curl -s --request GET \
  --url "https://www.virustotal.com/api/v3/files/$(sha256sum suspicious.exe | awk '{print $1}')" \
  --header "x-apikey: YOUR_API_KEY" | jq '.data.attributes.last_analysis_stats'

Workflow 2 — Dynamic Analysis with Network Simulation

# 1. Start network simulation
sudo fakenet -c /etc/fakenet/fakenet.ini -d
# Or: sudo inetsim

# 2. Capture all traffic from the analysis
sudo tcpdump -i lo -w analysis.pcap &

# 3. Run the suspicious file in an isolated VM
./suspicious.exe

# 4. After execution, analyze captured traffic
tshark -r analysis.pcap -Y "dns" -T fields -e dns.qry.name | sort -u

# 5. Check what the malware tried to do
cat /var/log/fakenet/protocol/http.log

Workflow 3 — Memory Dump Analysis

# 1. If you have a memory dump from the infected system:
vol -f memory.dump windows.pslist
vol -f memory.dump windows.netscan
vol -f memory.dump windows.cmdline

# 2. Check for suspicious processes
vol -f memory.dump windows.pslist | grep -iE "powershell|rundll|cscript|wscript|svchost"

# 3. Check network connections from the dump
vol -f memory.dump windows.netscan

# 4. Dump a suspicious process for further analysis
vol -f memory.dump windows.memmap.Memmap --pid 1234 --dump

REMnux + FLARE VM — The Standard Analysis Pair

Recommended setup:

• Run REMnux on a host-only VM network
• Run FLARE VM on the same host-only network
• Configure FLARE VM to use REMnux as its DNS and gateway
• Execute malware in FLARE VM; REMnux catches all outbound traffic

Maintaining REMnux

# Update all tools
sudo remnux update

# Verify all tools are working
remnux check

# Install additional Python packages
sudo remnux python-packages install yara-python

# Reset REMnux to defaults
sudo remnux reset

# View tool documentation
remnux help <toolname>

Related

• Ghidra — detection and response for T1204 techniques
• EDR Basics — detection and response for T1059, T1003, T1055, T1204, T1562 techniques
• Kill Chain — covers the kill chain concepts
• Malware Analysis Fundamentals — detection and response for T1204 techniques
• MITRE ATT&CK for Triage — covers the mitre att&ck for triage concepts

Sources

• REMnux Documentation
• REMnux Download Page
• REMnux GitHub Repository
• FLARE VM — Mandiant GitHub
• SANS — The REMnux Malware Analyst’s Toolbag
• MITRE ATT&CK — T1204 User Execution