Docker Images of Malware Analysis Tools

Last updated 2 years ago

The REMnux toolkit provides images of popular malware analysis tools that you can run on any compatible system even without installing the REMnux distro. These images reside in the , and are based on the files maintained in the .

In addition to the Docker images of individual tools, described below, you can run the .

Docker is installed as part of the REMnux distro. If you're planning to run REMnux Docker images on another system, you may need to . The first time you run an (e.g., using the docker run command), Docker will automatically download the image from Docker Hub, run it locally as an active . Your system will need to be connected to the internet to retrieve the image; afterwards, Docker will use a locally cached copy. You can use the docker pull command to update the cached version of the image. To update all local images from a Linux-like shell, run:

The following Docker images of malware analysis tools are available as part of REMnux. If you have the expertise, consider adding to this collection by to the REMnux toolkit.

Thug Low-Interaction Honeyclient

is a low-interaction honeyclient for examining suspicious websites. This tool was created by Angelo Dell'Aera. It's licensed under . In addition to being available as a Docker image, as part of the REMnux distro.

One way to run Thug as a Docker image is to invoke it using the following command to open a shel in the container where you can run thug with the desired parameters, such as -F to enable file logging).

The password for the container's user thug is thug. The remnux/thug image is hosted on .

Binary Refinery

The ™ is a collection of Python scripts that implement transformations of binary data such as compression and encryption. You can chain the tools as necessary to achieve your objective. This toolkit is authored by Jesko Hüttenhain and licensed under the .

To run Binary Refinery tools within the "remnux/binary-refinery" container, create a directory where you'll store your input files, e.g. ~/workdir. Then, use a command like this to launch the container and have your directory mapped as /home/nonroot/workdir inside the container:

The binary-refinery Docker image is hosted in .

For documentation about this toolkit, including the listing of its tools, see and .

JSDetox JavaScript Analysis Tool

You can use the following command to launch the JSDetox Docker image, with the application listening locally on TCP port 3000. You can then connect to http://localhost:3000 using your web browser:

de4js JavaScript Deobfuscator and Unpacker

You can use the following command to launch the de4js Docker image, with the application listening locally on TCP port 4000. You can then connect to http://localhost:4000/de4js/ using your web browser:

It's important to remember the trailing slash as part of the de4js URL http://localhost:4000/de4js/.

Rekall Memory Forensic and Incident Response Framework

To run Rekall, create a directory where you'll store the files you plan to examine. Then, use a command like this to open a shell inside the container where you can run rekall and have your evidence directry mapped as /home/nonroot/files inside the container:

RetDec Retargetable Machine-Code Decompiler

To run RetDec, create a directory where you'll store the files you plan to examine. Then, open a shell inside the container where you can run RetDec commands and have your local directory mapped as /tmp/files inside the container:

The commands provided by RetDec include start with the retdec- prefix and include retdec-decompiler.py, retdec-unpacker, and retdec-fileinfo.

Rizin Reverse-Engineering Framework

To run Rizin, create a directory where you'll store the files you plan to examine. Then, open a shell inside the container where you can run Rizin commands (rizin and others that start with rz-) and have your local directory mapped as /home/nonroot/workdir inside the container:

If you're planning to peform kernel-mode debugging, process tracing, or syscall tracing inside the container, then supply the parameters --cap-drop=ALL --cap-add=SYS_PTRACE when launching it.

Radare2 Reverse-Engineering Framework

To run Radare2, create a directory where you'll store the files you plan to examine. Then, open a shell inside the container where you can run Radare2 commands and have your local directory mapped as /home/nonroot/workdir inside the container:

If you're planning to peform kernel-mode debugging, process tracing, or syscall tracing inside the container, then supply the parameters --cap-drop=ALL --cap-add=SYS_PTRACE when launching it.

Viper Binary Analysis and Management Framework

To run Viper, create a directory where you'll store your malware samples. Then, use a command like this to open a shell inside the container where you can run viper and have your samples directory mapped as /home/nonroot/workdir inside the container:

To run the "clamav" Viper plugin, the clamav-daemon must be running in the container. You can enable it by running the following command in the container:

Ciphey Automatic Decoder and Decrypter

To run Ciphey using this Docker container, create a directory (e.g. ~/workdir) where you'll store your input file (e.g., input.txt). Then, use a command like this to run Ciphey and have your directory mapped into the container:

Or for a text input on the command-line run:

Last updated 2 years ago