Release of REMnux 7.0, a distribution for malware analysis

Five years after the publication of the last release is formed the new release of a specialized Linux distribution REMnux 7.0, designed for studying and reverse engineering malicious code. During the analysis, REMnux provides an isolated laboratory environment where one can emulate the operation of a specific targeted network service to study the behavior of malware in conditions close to reality. Another area of application for REMnux is the examination of the properties of malicious inserts on websites implemented in JavaScript.

The distribution is built on the package base of Ubuntu 18.04 and uses the LXDE desktop environment. Firefox comes as the web browser, equipped with the NoScript extension. The distribution includes a comprehensive set of tools for malware analysis, utilities for reverse engineering code, programs for studying modified malicious PDF and office documents, and tools for monitoring activity in the system. The size of the boot image of REMnux, tailored for launch virtualization systems, amounts to 5.2 GB. In this new release, all the available tools have been updated and the composition of the distribution has been significantly expanded (the size of the virtual machine image has doubled). The list of available utilities is categorized.

Included are the following tools:

• Website Analysis: Thug, mitmproxy, Network Miner Free Edition, curl, Wget, Burp Proxy Free Edition, Automater, pdnstool, Tor, tcpextract, tcpflow, passive.py, CapTipper, yaraPcap.py;
• Analysis of malicious Flash videos: xxxswf, SWF Tools, RABCDAsm, extract_swf, Flare;
• Java Analysis: Java Cache IDX Parser, JD-GUI Java Decompiler, JAD Java Decompiler, Javassist, CFR;
• JavaScript Analysis: Rhino Debugger, ExtractScripts, SpiderMonkey, V8, JS Beautifier;
• PDF Analysis: AnalyzePDF, Pdfobjflow, pdfid, pdf-parser, peepdf, Origami, PDF X-RAY Lite, PDFtk, swf_mastah, qpdf, pdfresurrect;
• Microsoft Office Document Analysis: officeparser, pyOLEScanner.py, oletools, libolecf, oledump, emldump, MSGConvert, base64dump.py, unicode;
• Shellcode Analysis: sctest, unicode2hex-escaped, unicode2raw, dism-this, shellcode2exe;
• Deobfuscating obfuscated code: unXOR, XORStrings, ex_pe_xor, XORSearch, brxor.py, xortool, NoMoreXOR, XORBruteForcer, Balbuzard, FLOSS
• Extraction of string data: strdeobj, pestr, strings;
• File Recovery: Foremost, Scalpel, bulk_extractor, Hachoir;
• Network Activity Monitoring: Wireshark, ngrep, TCPDump, tcpick;
• Network Services: FakeDNS, Nginx, fakeMail, Honeyd, INetSim, Inspire IRCd, OpenSSH, accept-all-ips;
• Network Utilities: prettyping.sh, set-static-ip, renew-dhcp, Netcat, EPIC IRC Client, stunnel, Just-Metadata;
• Working with a collection of malware samples: Maltrieve, Ragpicker, Viper, MASTIFF, Density Scout;
• Signature Detection: YaraGenerator, IOCextractor, Autorule, Rule Editor, ioc-parser;
• Scanning: Yara, ClamAV, TrID, ExifTool, virustotal-submit, Disitool;
• Working with hashes: nsrllookup, Automater, Hash Identifier, totalhash, ssdeep, virustotal-search, VirusTotalApi;
• Malware analysis for Linux: Sysdig, Unhide
• Disassemblers: Vivisect, Udis86, objdump;
• Debuggers: Evan’s Debugger (EDB), GNU Project Debugger (GDB);
• Tracing Systems: strace, ltrace
• Investigate: Radare 2, Pyew, Bokken, m2elf, ELF Parser;
• Working with text data: SciTE, Geany, Vim;
• Working with images: feh, ImageMagick;
• Working with binary files: wxHexEditor, VBinDiff;
• Memory dump analysis: Volatility Framework, findaes, AESKeyFinder, RSAKeyFinder, VolDiff, Rekall, linux_mem_diff_tool;
• Analysis of executable PE files UPX, Bytehist, Density Scout, PackerID, objdump, Udis86, Vivisect, Signsrch, pescanner, ExeScan, pev, Peframe, pedump, Bokken, RATDecoders, Pyew, readpe.py, PyInstaller Extractor, DC3-MWCP;
• Malware analysis for mobile devices: Androwarn, AndroGuard.

Source: opennet.ru