Hello everyone. 1
Welcome to another video of Expert Malware Analysis and Reverse engineering course and in this 2
video we are briefly going to talk about REMnux 3
So what exactly is Remnux. Remnux is a linux toolkit for reverse engineering and analyzing malwares. 4
in the previous couple of videos 5
We worked extensively on setting up a virtual environment where we downloaded images of Windows 7 and 6
Windows 10, to set up our virtualization environment. 7
We downloaded virtualization tools to get ourself set up and running. 8
We also spent time on downloading lots of different tools using the Flare VM so that we have our entire 9
setup ready. Remnux provides us a single Linux distro which comes pre-compiled as OVA file or 10
as a virtual image that you can quickly boot into your virtualization software and you dont have 11
to really worry about installing tools or getting images and stuff like that. 12
This is where Remnux is very useful. 13
Remnux is basically developed by SANS which is a very popular certification company that runs a lot 14
of technical certification programs. 15
So some of the good features about this Linux distro is that it comes with a lot of tools that can be 16
helpful during malware analysis. 17
One of the best feature that I like about them is that it comes with containers as well. 18
So they are basically docker images for mlaware analysis tools where you can quickly load up the Docker 19
image and do the analysis and once you are done you basically kill that image and infection just stays 20
out. In the later stages 21
Once we are done with analyzing files manually on virtual machines, we will be looking into analyzing 22
docker containers as well. 23
So that was all about Remnux. it was just a quick brief. 24
I would highly encourage you all to just go ahead. 25
Go to Remnux.org. You can download the distro from there and you can just load into virtualization 26
software and you can start playing around with it. 27
Here is a running instance on my machine. 28
Once you are set up once you boot it you'll see something similar here. 29
You can go to Start, you can go to other and from there you can see a bunch of tools that are there. 30
It is not really the exhaustive list there are a lot of other tools as well which are present inside 31
Remnux. 32
One of the most useful things is the Remnux cheat-sheet. 33
This is very handy. 34
It contains a lot of tools that we can use in different stages of malware analysis. 35
If you look here they have mentioned all the tools under different headings for example how we examined 36
all of malware. 37
Let's begin with spidermonkey we can use Rhino the. 38
We can use firebug for examining memory using volatility to have listed all the important commands 39
that are related to Volatility and stuff like that. 40
This cheat-sheet is really really handy. 41
And we can refer back to it anytime when we want to let's say pick up new tool to understand 42
a file or really extract the deeper components of a fly to uncover malicious traits. 43
So there was all about Remnux. Just go ahead download it and play with it and let me know how was 44
your experience. 45
Thanks a lot.