Author Topic: REMnux for analyzing malware on Linux  (Read 5100 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33900
  • malware fighter
REMnux for analyzing malware on Linux
« on: July 13, 2010, 12:38:16 AM »
Hi malware fighters,

You can download it here:
http://c96e5c94.linkbucks.com/

Tools included on REMnux:
Analyzing Flash malware: swftools, flasm, flare
Analyzing IRC bots: IRC server (Inspire IRCd) and client (Irssi). To launch the IRC server, type “ircd start”; to shut it down “ircd stop”. To launch the IRC client, type “irc”.
Network-monitoring and interactions: Wireshark, Honeyd, INetSim, fakedns and fakesmtp scripts, NetCat
JavaScript de-obfuscation: Firefox with Firebug, NoScript and JavaScript Deobfuscator extensions, Rhino debugger, two versions of patched SpiderMonkey, Windows Script Decoder, Jsunpack-n
Interacting with web malware in the lab: TinyHTTPd, Paros proxy
Analyzing shellcode: gdb, objdump, Radare (hex editor+disassembler), shellcode2exe
Dealing with protected executables: upx, packerid, bytehist, xorsearch, TRiD
Malicious PDF analysis: Dider’s PDF tools, Origami framework, Jsunpack-n, pdftk
Memory forensics: Volatility Framework and malware-related plugins
Miscellaneous: unzip, strings, ssdeep, feh image viewer, SciTE text editor, OpenSSH server

REMnux is a virtual server we liked it very much. It is easy to use if you can play with Linux,

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!