# REMnux: A Linux Toolkit for Malware Analysis

<figure><img src="https://2447964970-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M9GZRzhNeBKowpoIMwv%2F-MCUkBTefQk6LGZ7vK-p%2F-MCUkxh8JLbiP6ElSAIg%2Fremnux-banner.png?alt=media&#x26;token=ebf210c8-080d-4b32-bbec-f4b13434f27c" alt=""><figcaption></figcaption></figure>

This site provides documentation for [REMnux](https://remnux.org/)®, a Linux toolkit for reverse-engineering and analyzing malicious software. REMnux provides a curated collection of free tools created by the community. Analysts can use it to investigate malware without having to find, install, and configure the tools. The toolkit also includes AI-powered capabilities that let AI assistants [run REMnux tools automatically](https://docs.remnux.org/tips/using-ai).

## Install the REMnux Distro

The heart of the toolkit is the REMnux Linux distribution based on [Ubuntu](https://ubuntu.com), which incorporates many tools that malware analysts use to:

* [Examine static properties of a suspicious file.](https://docs.remnux.org/discover-the-tools/examine+static+properties)
* [Statically analyze malicious code.](https://docs.remnux.org/discover-the-tools/statically+analyze+code)
* [Dynamically reverse-engineer malicious code.](https://docs.remnux.org/discover-the-tools/dynamically+reverse-engineer+code)
* [Perform memory forensics of an infected system.](https://docs.remnux.org/discover-the-tools/perform+memory+forensics)
* [Explore network interactions for behavioral analysis.](https://docs.remnux.org/discover-the-tools/explore+network+interactions)
* [Investigate system-level interactions of malware.](https://docs.remnux.org/discover-the-tools/investigate+system+interactions)
* [Analyze malicious documents.](https://docs.remnux.org/discover-the-tools/analyze+documents)
* [Gather and analyze threat data.](https://docs.remnux.org/discover-the-tools/gather+and+analyze+data)

The [Discover the Tools](https://docs.remnux.org/discover-the-tools/examine+static+properties) section of this documentation site provides the REMnux tools listing and offers notes for using them.

To get started with REMnux, you can:

* [Download the virtual appliance](https://docs.remnux.org/install-distro/get-virtual-appliance) of the REMnux distro.
* [Install the REMnux distro from scratch](https://docs.remnux.org/install-distro/install-from-scratch) on a dedicated system.
* [Add the REMnux distro](https://docs.remnux.org/install-distro/add-to-existing-system) to an existing machine.
* [Run the REMnux distro as a Docker container.](https://docs.remnux.org/install-distro/remnux-as-a-container)

## Run Tools in Containers <a href="#run-in-containers" id="run-in-containers"></a>

The REMnux toolkit also offers [Docker images of popular malware analysis tools](https://docs.remnux.org/run-tools-in-containers/remnux-containers), making it possible to run them as containers without having to install the tools directly on the system.

## Get Involved with the Project

You can participate in the REMnux project by:

* [Asking and answering questions](https://docs.remnux.org/get-involved/ask-and-answer-questions) related to the distro and its tools.
* [Adding or updating tools](https://docs.remnux.org/get-involved/add-or-update-tools) that comprise the distribution.
* [Creating articles, blog posts, and videos](https://docs.remnux.org/get-involved/write-about-the-tools) about the tools on REMnux.

## Learn More About REMnux

You can learn about:

* [Using AI](https://docs.remnux.org/tips/using-ai) to run malware analysis tools with AI assistants
* [REMnux configuration tips](https://docs.remnux.org/tips/remnux-config-tips) for getting the most out of the distro
* [Tips for using the tools](https://docs.remnux.org/tips/remnux-tool-tips) on REMnux
* [People](https://docs.remnux.org/behind-the-scenes/people) and [technologies](https://docs.remnux.org/behind-the-scenes/technologies) that make REMnux possible

Many of the tools available in the REMnux toolkit are discussed in the SANS course [FOR610: Reverse Engineering Malware](https://sans.org/for610). Lenny Zeltser, the founder and primary maintainer of REMnux, is also the primary author of this course.