REMnux
Ubuntu-based toolkit for reverse-engineering and analyzing malicious software
Last verified September 4, 2026
REMnux is a Linux toolkit, created by Lenny Zeltser, focused on reverse-engineering and analyzing malicious software: static and dynamic binary analysis, memory forensics, network traffic inspection, and deobfuscation tools for scripts and documents used in malware delivery.
REMnux is intended for malware analysis, incident response, and security research. Only analyze samples/systems you own or are explicitly authorized to examine — see the disclaimer.
Notable bundled tools
AESKeyFinder
Find 128-bit and 256-bit AES keys in a memory image.
binwalk
Tool library for analyzing binary blobs and executable code
ghidra
Software Reverse Engineering Framework
PolarProxy
Intercept and decrypt TLS traffic.
RSAKeyFinder
Find BER-encoded RSA private keys in a memory image.
yara
Pattern matching swiss knife for malware researchers
Getting started
REMnux is distributed as a pre-built virtual appliance (OVA) for VMware/VirtualBox, or it can be layered onto an existing Ubuntu installation via an install script. The virtual appliance is the fastest way to start: import it into your hypervisor and boot into a desktop with malware analysis tooling preinstalled. The official docs cover both installation paths, plus running individual tools as Docker containers instead of installing the full distro.