REMnux

REMnux® is a free Linux toolkit for reverse-engineering and analyzing malware. Follow this account, managed by @lennyzeltser, for #REMnux updates and news.

[Lenny Zeltser @lennyzeltser]

The REMnux MCP server can now draft malware analysis reports using my new report template:

https://t.co/kKcs6FolUl

[REMnux @REMnux]

Version 12.1 of Ghidra is now on REMnux. Get it by updating your system using "remnux install" https://t.co/7oAuF2kNpP

[Kyle Cucci @d4rksystem]

@SquiblydooBlog @luke92881 Nice usage of Remnux MCP! I gotta get this set up, been hearing goood things 👍

[Kostas @Kostastsale]

Testing the new GPT-5.4 inside REMnux with real malicious artifacts, memory dumps, and the custom analysis skill I built for it.

Honestly… this is next level.

The speed at which it pivots through artifacts, correlates behavior, and surfaces relevant findings is something I haven’t seen before.

Still early testing, but very impressive so far.

[REMnux @REMnux]

Added Malcat Lite (@malcat4ever) to REMnux for analyzing binary files using a hex editor, disassembler, and file dissector: https://t.co/wERJqvshIM

[Squiblydoo @SquiblydooBlog]

As also mentioned by @malwrhunterteam , the actor also signed a copy of Microsoft's OLEVIEW.exe.

I analyzed it with the new MCP in @REMnux and this is what it found:

It found that there was a PNG, and after the PNG was another fake PNG, which was an encrypted payload.
1/5

[REMnux @REMnux]

REMnux v8 brings AI integration to the Linux malware analysis toolkit, by @helpnetsecurity:
https://t.co/WK0V10Aqyr

[9to5Linux @9to5linux]

#Ubuntu-Based REMnux 8 #Linux Toolkit for Malware Analysis Is Out Now to Celebrate the Project's 15th Anniversary https://t.co/pllhya1gtJ

@REMnux #OpenSource

[Squiblydoo @SquiblydooBlog]

Nice! It did a good job with this FUD Webex installer signed by "LAKESIDE TRANSMISSION INC."

40adf1aaa86dbe99cafa24fcfc7847fac976fc3d01d07cc6a774970028bbffdd

Now if only I could convince Microsoft to finally revoke this certificate.

[REMnux @REMnux]

The release announcement is now available, but you heard it here first! https://t.co/VS1q6TmyU8

[REMnux @REMnux]

REMnux based on Ubuntu 24.04 (Noble) is available now, along with a new, more resilient installer. Available as prebuilt VMs for VMware, Proxmox and VirtualBox, as well as a Docker container. Get your malware analysis toolkit from https://t.co/ztNfHgnq9O.

[Lenny Zeltser @lennyzeltser]

The new @REMnux MCP server lets AI analyze malware using the REMnux toolkit. I was surprised at the depth of investigation it delivers. Most of my time went into capturing how I approach malware analysis and providing AI the right guidance at the right time, so it can think and adapt as it works.

https://t.co/SRgIUJV304

[REMnux @REMnux]

REMnux based on Ubuntu 24.04 (Noble) is available now, along with a new, more resilient installer. Available as prebuilt VMs for VMware, Proxmox and VirtualBox, as well as a Docker container. Get your malware analysis toolkit from https://t.co/ztNfHgnq9O.

[REMnux @REMnux]

The updated version of Ghidra (11.2) is now on REMnux. To get it, you can run "apt get && apt install ghidra"
https://t.co/1U2gGFztx6

[Kyle Cucci @d4rksystem]

#MalwareAnalysis tip: Inetsim is a network simulator for malware analysis. You can host your own files/payloads in inetsim really easily. I had to do this today to analyze a shellcode implant that was no longer hosted on its staging domain.

Here is how to do this 👇

[REMnux @REMnux]

Added Magika to REMnux for identifying file types: https://t.co/cB09rp74ic

[Josh Stroschein | The Cyber Yeti @jstrosch]

Continuing with the videos introducing key analysis distributions for malware analysis and reverse engineering - next up is @REMnux 👇

📽️ https://t.co/cHbNWphLVf

I'll discuss what is, why/when I use it and how to get started.

[REMnux @REMnux]

If you get an error when trying to upgrade REMnux, this might be due to an issue with SaltStack, which we've been working to address. One way around it is to manually install the latest REMnux installer, then try running "remnux upgrade" again: https://t.co/EB24Zww1WT

[REMnux @REMnux]

Added "debloat" by @SquiblydooBlog, which offers a handy way to remove junk contents from bloated Windows executables: https://t.co/IfrRXwNVWk

[REMnux @REMnux]

To get this and other updates on your REMnux system, run "remnux upgrade".

[REMnux @REMnux]

Added "dnfile" by @MalwareFrank and "dotnetfile" by @Unit42_Intel to REMnux for analyzing static properties of .NET files: https://t.co/KLgPU2uO8r