📄
REMnux Documentation
  • REMnux: A Linux Toolkit for Malware Analysis
  • Install the Distro
    • Get the Virtual Appliance
    • Install from Scratch
    • Add to an Existing System
    • Run REMnux as a Container
    • Keep the Distro Up to Date
  • Discover the Tools
    • Examine Static Properties
      • General
      • PE Files
      • ELF Files
      • .NET
      • Deobfuscation
    • Statically Analyze Code
      • General
      • Unpacking
      • PE Files
      • Python
      • Scripts
      • Java
      • .NET
      • Flash
      • Android
    • Dynamically Reverse-Engineer Code
      • General
      • Shellcode
      • Scripts
      • ELF Files
    • Perform Memory Forensics
    • Explore Network Interactions
      • Monitoring
      • Connecting
      • Services
    • Investigate System Interactions
    • Analyze Documents
      • General
      • PDF
      • Microsoft Office
      • Email Messages
    • Gather and Analyze Data
    • View or Edit Files
    • General Utilities
  • Run Tools in Containers
    • Docker Images of Malware Analysis Tools
  • Behind the Scenes
    • People
    • Technologies
      • SaltStack Management
      • REMnux Installer
      • State Files Without the REMnux Installer
      • Debian Packages
      • Website and Docs
    • License
  • Tips and More
    • REMnux Configuration Tips
    • REMnux Tool Tips
    • Malware Analysis Training
    • REMnux Website
  • Get Involved
    • Ask and Answer Questions
    • Write About the Tools
    • Add or Update Tools
      • Contribute a Salt State File
      • Contribute a Debian Package
      • Contribute a Dockerfile
    • Implement Enhancements
Powered by GitBook
On this page
  • Step 1: Download the Virtual Appliance File
  • Step 2: Confirm the Hash the OVA File
  • Step 3: Import the OVA File
  • Step 4: Start the REMnux Virtual Machine
  • Step 5: Consider Special Hypervisor Requirements
  • VirtualBox
  • VMware
  • Hyper-V
  • Remote Cloud, Such as AWS
  • KVM/QEMU
  • Proxmox
  • Step 6: Upgrade the REMnux Virtual Machine
  • Step 7: Take a Snapshot of the Virtual Machine
  1. Install the Distro

Get the Virtual Appliance

PreviousREMnux: A Linux Toolkit for Malware AnalysisNextInstall from Scratch

Last updated 7 months ago

The easiest way to get the REMnux distro is to download the REMnux virtual appliance in the OVA format, import it into your hypervisor, then to make sure it's up-to-date.

REMnux is based on an x86/amd64 version of Ubuntu, and won't run on an ARM processor such as Apple M-series.

Step 1: Download the Virtual Appliance File

The REMnux virtual appliance approximately 5 GB. It comes as an industry-standard OVA file, which you can import into your virtualization software. It's based on Ubuntu 20.04 (Focal).

Decide which OVA file to download. Unless you're using Oracle VM VirtualBox, get the general OVA file. If you're using VirtualBox, get the VirtualBox version. Download your preferred OVA file:

This general OVA file works with most hypervisors. If you're using VirtualBox, get the VirtualBox version instead from the other tab:

Download the general OVA file from (primary) or (mirror).

This VirtualBox OVA file is specifically for VirtualBox. Get the general version from the other tab if you're using other hypervisors:

Download the VirtualBox OVA file from (primary) or (mirror)

Some browsers () change the extension of the OVA file after downloading it, possibly giving it the incorrect .ovf extension. If that happens, rename the file so it has the .ova extension before proceeding.

Step 2: Confirm the Hash the OVA File

Validate the SHA-256 hash of the downloaded file using a tool such as sha256sum or shasum to make sure it matches this expected value:

The general OVA file:

796a259733604b10c69a7b060e64eeccd459e33f327f8d9faf9fd22a1ca19645

The VirtualBox OVA file:

c93477a075a61398e6cc3e03b3b6ba8269b74f92cdc13d151d6b566bc86196fc

Step 3: Import the OVA File

If possible, upgrade your virtualization software to the latest version. Then, use it to import the downloaded OVA file. If you're not sure how to do that, follow the instructions below:

When importing the REMnux virtual appliance, allocate resources such as RAM and disk space based on what you have available. REMnux is a relatively lightweight distro, but the more you allocate to it, the faster it will run. As a point of reference, most people find 4 GB RAM and 60 GB disk sufficient.

Step 4: Start the REMnux Virtual Machine

Once you start your REMnux virtual machine, it will automatically log you into the REMnux environment.

There is no logon screen for accessing the REMnux environment, because analysts generally use REMnux on a system to which physical access is already restricted. When you need to elevate your privileges or access the REMnux virtual appliance remotely, note the follow default credentials:

Username: remnux Password: malware

Step 5: Consider Special Hypervisor Requirements

Depending on which hypervisor or environment you're using, you might need to take the following steps:

VirtualBox

If your REMnux window is too small when you boot it up the system in VirtualBox, activate the Scaling Mode for the VM via the VirtualBox menu View > Scaling Mode.

If your REMnux virtual machine is unable to communicate over the network, check whether has a network interface other than the loopback ("lo") by running the ifconfig command. If a non-loopback interface is missing, perform the following steps to add it:

  1. Run the networkctl command to determine the name of the adapter ("link") of type "ether". It might be named something like "enp0s17".

  2. Set up the network interface by replacing YOUR_NIC in the following command with the name you've identified in the previous step (e.g., "enp0s17)": sudo ip link set up YOUR_NIC

  3. Edit the /etc/netplan/01-netcfg.yaml file (e.g., use the code command). Under "ethernets:" replace the name there (e.g, "ens33") with the name of your network card (e.g., "enp0s17").

  4. Reboot your REMnux virtual machine.

VMware

If you encounter this issue, try configring your REMnux virtual machine to switch from Wayland to Xorg. The change should be unnoticeable to your user experience, but it might address the VMware issue. To make the switch, switch to the root user account (sudo -s) and edit the file /etc/gdm3/custom.conf. Uncomment this line:

#WaylandEnable=false

So it says:

WaylandEnable=false

Then reboot your virtual machine (reboot).

Hyper-V

It's possible to import the pre-built REMnux virtual appliance into Hyper-V, but you'll need to take a few conversion steps. You'll need to extract the contents of the REMnux OVA file to obtain the enclosed VMDK file that captures the virtual disk of the distro, then convert it to the VHD format supported by Hyper-V:

  1. Extract the downloaded OVA file using a tool such as "tar". One of the extracted files will have the .vmdk.gz name, such as remnux-v7-focal-disk1.vmdk.gz.

  2. Decompress the extracted .vmdk.gz file using a tool such as "gunzip" to generate a file with the .vmdk extension.

  3. Import the generated VHD file into Hyper-V.

Remote Cloud, Such as AWS

The REMnux virtual appliance ships in "dedicated" installation mode, which automatically turns off the SSH daemon. This configuration is generally desirable when running REMnux in a local lab. If you're deploying the virtual appliance in a cloud environment, you might need to keep SSH enabled to remotely access your REMnux system. In that case:

  1. Edit the /etc/remnux-config and change the mode from dedicated to cloud.

  2. Enable the SSH daemon by running: sudo systemctl enable ssh.

  3. Change the default user's password and otherwise strengthen the SSH authentication method according to your requirements and risk tolerance.

  4. Reboot your REMnux system.

KVM/QEMU

Proxmox

After importing the OVA to Proxmox, go into the Options for the VM and modify Boot Order to enable the disk that was imported as an OVA.

Once done, consider taking the following steps using the Proxmox interface:

  1. VM > Hardware > Display > Set to > SPICE(qxl)

  2. VM > Hardware > Option > Spice Enhancements > Video Streaming: all

After this:

  1. Switch CPU type to 'qemu32'.

  2. Boot the VM and let it fail startup. It'll be obvious it's not booting properly because the display will not work properly, and you'll never see the desktop.

  3. Hard power off the VM.

  4. Switch CPU type to 'qemu64'.

  5. Boot the VM. It should properly initialize the display and boot to the desktop.

Step 6: Upgrade the REMnux Virtual Machine

After installing the REMnux virtual machine, run the following command inside the VM as a regular, non-root user to upgrade it to the latest version of the distro:

remnux upgrade

Step 7: Take a Snapshot of the Virtual Machine

Consider taking a snapshot of your REMnux virtual machine, so you can return it to a known good state if the need arises.

If necessary, of your system to match your locale and setup.

If running VirtualBox on Windows 10, be sure to using the command bcdedit /set hypervisorlaunchtype off. Do this even if Hyper-V appears disabled in the Windows Features listing. If you don't, you are likely to run into problems downloading files and updating REMnux.

VMware sometimes conflicts with the Ubuntu graphical environment, which by default uses display protocol. The problems manifest themselves through the VM being unresponsive to keyboard and mouse; clipboard sharing and copy-and-paste VMware features might not be working, too.

Download the General OVA of the REMnux distro, as .

Use (qemu-img convert -O vhdx -o subformat=dynamic) or to convert the .vmdk file to the VHD format supported by Hyper-V.

For an overview of this process, see the video by Cyrus.

If you converted the REMnux virtual appliance to KVM/QEMU, install the "" package in the virtual machine to be able to resize the windows of your VM and copy/paste between it and your host.

If you plan to use the REMnux virtual appliance in Proxmox, to import the OVA. However, note that the article incorrectly specifies a CPU type of kvm64 in the screenshots. The correct CPU type for REMnux is qemu64.

For more details about keeping your REMnux environment current, so you benefit from the latest enhancements, see the section.

run the upgrade command
Box
SourceForge
Box
SourceForge
e.g., Brave
VMware Workstation
VMware vSphere
VMware Fusion
Oracle VM VirtualBox
KVM/QEMU
AWS
Proxmox
disable Hyper-V
Wayland
qemu-img
StarWind V2V Converter
How To Install REMnux on Windows 10 Hyper-V
spice-vdagent
follow the steps in this article
Keeping REMnux Up to Date
Hyper-V
outlined above
change the keyboard layout