SHARE

REMnux: The Linux Toolkit for Reverse Engineering and Malware Analysis

REMnux is a free community distribution that ethical hackers, security researchers, and many other security pros can leverage to build their own labs and speed up malware analysis. Whether you’re new to these specialties or an experienced investigator, REMnux contains many helpful Debian packages and configurations to perform advanced tasks, such as: We’ll examine the […]

Written By

Julien Maury

Nov 7, 2022

eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More

REMnux is a free community distribution that ethical hackers, security researchers, and many other security pros can leverage to build their own labs and speed up malware analysis.

Whether you’re new to these specialties or an experienced investigator, REMnux contains many helpful Debian packages and configurations to perform advanced tasks, such as:

Extracting IoCs (Indicators of Compromise)
Disassembling/decompiling binaries or windows executables (such as PE files)
Decoding, deobfuscating, decyphering, and decrypting
Tampering (such as Burp Suite, Thug) and other network analysis (such as Wireshark)
Investigating malicious code in various platforms (such as Android) and languages (e.g., Python, PowerShell, Java)
Analyzing memory for code injections and other malicious activities
Examining suspicious documents (such as PDFs, Microsoft Office, emails)

We’ll examine the pros and cons, but REMnux is definitely a great asset for those who want to focus on their work and skip the “installation hell.”

See our tutorials on Metasploit, Burp Suite and Nmap

Getting Started with REMnux

REMnux can be installed in a number of ways.

The tool is available as a ready-to-use virtual machine (.ova), which means it can run everywhere (Windows, Mac, Linux), but you can also add it directly to an existing system based on Ubuntu 20.04 with the REMnux installer (less than 60 MB).

Be careful if you have a next-gen Apple machine (m1++). At the time of writing, REMnux won’t run on an ARM processor such as Apple M1 or M2, as it’s based on an x86/amd64 version of Ubuntu (source: REMnux documentation).

I prefer using the virtual machine, as it provides an isolated environment and you can save snapshots, which is particularly convenient when you need to analyze ransomware and other sensitive binaries that can literally destroy your system.

So get the OVA image and import it into your favorite software, for example, Virtual Box or VMware.

What Problem Does REMnux Solve?

As the founder and primary maintainer of REMnux, Lenny Zeltser likes to say:

REMnux is for malware analysis as Kali is for penetration testing.

Kali Linux actually contains forensic tools, but the distro is meant for pentesting, and you usually have to install additional resources to perform malware analysis and reverse engineering correctly.

As these resources have their own dependencies, it’s sometimes a bit difficult to make them work properly on a system that is not meant for that, which can be very time-consuming, and sometimes frustrating because of the multiple incompatibilities and dependency conflicts.

See the Best Open-Source Distributions for Pentesting and Forensics

REMnux Pros

It’s totally free and its components are open source
It’s beginner friendly and well documented
It’s easy to install (OVA, docker image, from scratch) and update (thanks to SaltStack technology)
It’s very popular among malware analysts and security professionals
The set is very comprehensive, so it’s unlikely you’ll need any additional resources
Tools are pre-packaged, tested, and pre-configured
You can use REMnux tools without even installing them, using Docker and REMnux containers

Cons

The latest big release, at the time of writing, is v7 in 2020
REMnux is a collection of open-source packages, which on one hand is great, but comes with the same dependency and update issues
The distro won’t teach you how to master the various tools provided even if the documentation contains useful links and demos

Why Use REMnux?

REMnux is not just another Linux distro for ethical hacking or forensics. It contains pretty much everything you need to perform various analyses.

The added value is the “glue” REMnux uses to make these hundreds of tools work together and remove the hassle of installing and configuring everything by yourself. Those are some compelling reasons to try it.

Julien Maury

eSecurity Planet contributor Julien Maury writes about penetration testing, code security, open source security and more. He is a backend developer, a mentor and a technical writer who enjoys sharing his knowledge and learning new concepts.