REMnux is also useful for analyzing web-based malware, like malicious JavaScript, Java programs and Flash files. It also has tools for analyzing malicious documents, such as Microsoft doc files, PDF files, and utilities for reversing malware through memory forensics. In these cases, malware may be loaded onto REMnux and analyzed directly without requiring other systems to be present in the lab.
There is a huge list of tools in this OS [excerpt from http://zeltser.com/remnux/ ] :
It doesn't cover all malware analysis tools, specially those designed for windows. Those who like to work in windows tools should look at ZeroWine project.Malware Analysis Tools Set Up On REMnux
Analyzing Flash malware: swftools, flasm, flare, RABCDAsm
Analyzing IRC bots: IRC server (Inspire IRCd) and clients (Irssi, ircII). To launch the IRC server, type "ircd start"; to shut it down "ircd stop". To launch the IRC client, type "irc".
Network-monitoring and interactions: Wireshark, Honeyd, INetSim, fakedns and fakesmtp scripts, NetCat
JavaScript deobfuscation: Firefox with Firebug, NoScript and JavaScript Deobfuscator extensions, Rhino debugger, two versions of patched SpiderMonkey, Windows Script Decoder, Jsunpack-n
Interacting with web malware: TinyHTTPd, Paros proxy, Burp Suite Free Edition, stunnel, VirusTotal VTzilla, User Agent Switcher, Tor and torsocks with "usewithtor"). To launch the Tor daemon, type "tor start"; to shut it down "tor stop".
Analyzing shellcode: gdb, objdump, Radare (hex editor+disassembler), shellcode2exe, libemu with "sctest", diStorm disassembler library
Dealing with suspicious files: upx, packerid, bytehist, xorsearch, TRiD, xortools.py, ClamAV, ssdeep, md5deep, pescanner.py
Malicious document file analysis: Didier's PDF tools, Origami framework, Jsunpack-n, pdftk, pyOLEScanner.py
Memory forensics: Volatility Framework with malware.py, AESKeyFinder and RSAKeyFinder.
Miscellaneous: unzip, strings, feh image viewer, SciTE text editor, OpenSSH server, VBinDiff file comparison/viewer.
You can download VMware version or Live cd version of this distribution.
References:
http://zeltser.com/remnux/
http://holisticinfosec.org/toolsmith/docs/september2010.html
I recently came across your blog and have been reading along. I thought I would leave my first comment. I don't know what to say except that I have enjoyed reading what you all have to say...
ReplyDeleteCelabright information