REMnux – Linux distribution for malware analysis

REMnux is a specialised Linux distribution designed for malware analysis, reverse engineering and digital forensics. Based on Ubuntu, it brings together a collection of tools for investigating malicious software and understanding how it behaves.

Developed by Lenny Zeltser and contributors, REMnux provides a ready-to-use analysis environment that reduces the effort involved in assembling and configuring individual security utilities. It is intended for security researchers, incident responders and malware analysts who need to examine suspicious files, investigate compromised systems and understand malicious activity.

The distribution provides a GNOME desktop alongside an extensive collection of command-line and graphical applications. It can be used as a dedicated analysis workstation, within a virtual machine or as a collection of tools added to an existing Ubuntu installation.

This is free and open source software.

Key Features

• Static analysis tools for examining executable files, extracting strings, inspecting metadata and identifying suspicious characteristics.
• Reverse engineering utilities for disassembling, debugging and analysing malicious code.
• Dynamic analysis tools for observing malware behaviour during execution.
• Memory forensics utilities for examining memory images and identifying malicious processes, injected code and other suspicious activity.
• Network analysis tools for inspecting traffic, analysing protocols and investigating malware communications.
• Utilities for examining malicious documents, including PDF files and Microsoft Office documents.
• Tools for analysing potentially malicious scripts, shellcode and obfuscated code.
• Facilities for investigating system-level interactions, including file activity and process behaviour.
• Tools for collecting and analysing threat intelligence and indicators of compromise.
• Customised GNOME desktop environment with convenient access to analysis applications.
• SaltStack-based configuration management for maintaining and updating the analysis environment.
• Integration with AI assistants through the REMnux MCP server for invoking analysis tools and interpreting results.