Friday, January 14, 2011

REMnux : Distro for Malware Analyst

REMnux is another pentesting OS that you would like to have in your arsenal. Basically, it aids investigating malwares, so it's a very handy OS for malware analysts for reverse engineering malicious piece of software. The distribution is based on Ubuntu. Along with analysing malwares, it can also assist analyzing IRC bots, network monitoring, javascript deobfuscation, analyzing shellcode, memory forensics etc.

REMnux is also useful for analyzing web-based malware, like malicious JavaScript, Java programs and Flash files. It also has tools for analyzing malicious documents, such as Microsoft doc files, PDF files, and utilities for reversing malware through memory forensics. In these cases, malware may be loaded onto REMnux and analyzed directly without requiring other systems to be present in the lab.
There is a huge list of tools in this OS [excerpt from http://zeltser.com/remnux/ ] :

Malware Analysis Tools Set Up On REMnux

Analyzing Flash malware: swftools, flasm, flare, RABCDAsm
Analyzing IRC bots: IRC server (Inspire IRCd) and clients (Irssi, ircII). To launch the IRC server, type "ircd start"; to shut it down "ircd stop". To launch the IRC client, type "irc".
Network-monitoring and interactions: Wireshark, Honeyd, INetSim, fakedns and fakesmtp scripts, NetCat
JavaScript deobfuscation: Firefox with Firebug, NoScript and JavaScript Deobfuscator extensions, Rhino debugger, two versions of patched SpiderMonkey, Windows Script Decoder, Jsunpack-n
Interacting with web malware: TinyHTTPd, Paros proxy, Burp Suite Free Edition, stunnel, VirusTotal VTzilla, User Agent Switcher, Tor and torsocks with "usewithtor"). To launch the Tor daemon, type "tor start"; to shut it down "tor stop".
Analyzing shellcode: gdb, objdump, Radare (hex editor+disassembler), shellcode2exe, libemu with "sctest", diStorm disassembler library
Dealing with suspicious files: upx, packerid, bytehist, xorsearch, TRiD, xortools.py, ClamAV, ssdeep, md5deep, pescanner.py
Malicious document file analysis: Didier's PDF tools, Origami framework, Jsunpack-n, pdftk, pyOLEScanner.py
Memory forensics: Volatility Framework with malware.py, AESKeyFinder and RSAKeyFinder.
Miscellaneous: unzip, strings, feh image viewer, SciTE text editor, OpenSSH server, VBinDiff file comparison/viewer.
It doesn't cover all malware analysis tools, specially those designed for windows. Those who like to work in windows tools should look at ZeroWine project.
You can download VMware version or Live cd version of this distribution.
References:
http://zeltser.com/remnux/
http://holisticinfosec.org/toolsmith/docs/september2010.html 

1 comment:

  1. I recently came across your blog and have been reading along. I thought I would leave my first comment. I don't know what to say except that I have enjoyed reading what you all have to say...
    Celabright information

    ReplyDelete