REMnux Distro Linux Untuk Analisis Malware

REMnux merupakan distro linux turunan dari Ubuntu , distro ini dikhususkan untuk melakukan analisa malware , Distro Linux ini dibangun untuk menganalisa program2 exe berbahaya yang berjalan pada sistem micr***** serta malware yang berjalan dibrowser seperti flash serta javascript . Distro ini juga mampu menganalisa dokumen berbahaya, tool2 yang ikut disertakan dalam distro REMnux terbaru

Tool untuk Analisis Malware Browser

• Thug: Honeyclient for investigating suspicious websites
• mitproxy: Intercept, modify, replay and save HTTP and HTTPS traffic
• Automater: Look up URL/Domain, IP and MD5 hash details
• Java Cache IDX Parser: Examine Java IDX files
• JSDetox: Decode obfuscated JavaScript
• ExtractScripts: Extract JavaScript scripts from an HTML file

Examine Document Files

• AnalyzePDF: Examine a malicious PDF file
• Pdfobjflow: Visualize the output from pdf-parser
• officeparser: Extract embedded files and macros from office documents

Extract and Decode Artifacts

• unXOR: Guess a XOR key via known-plaintext attacks
• XORStrings: Locate and decode XOR-obfuscated strings
• ex_pe_xor: Carve out single-byte XOR encoded executables from files
• Balbuzard: Extract and decode suspicious patterns from malicious files
• Foremost: Carve contents of files
• Scalpel: Carve contents of files
• strdeobj: Extract and decode strings defined as arrays

Handle Network Interactions

• tcpick: Sniffer that reassembles TCP streams
• prettyping.sh: Ping a host while looking pretty

Process Multiple Samples

• Maltrieve: Retrieve malware from malicious sites
• Ragpicker: Malware crawler with analysis and reporting functionality
• Viper: Store, classify and investigate suspicious binary files

Examine File Properties and Contents

• YaraGenerator: Generate Yara rules for designated files
• Yara Editor: Create and modify Yara rules
• IOCextractor: Extract indicators of compromise from a text report file
• Hash Identifier: Identify the types of a hash being examined
• nsrllookup: Look up file hashes on an NSRL database server
• totalhash: Look up a suspicious file hash in the totalhash.com database

Investigate Linux Malware

• Sysdig: Track and examine local system activities on a Linux system
• Unhide: Find local hidden processes or connections on a Linux system
• Bokken: Interactive static malware analysis tool
• Vivisect: Statically examine and emulate the execution of binary files

Other Tools

• wxHexEditor: Graphical hex editor
• TotalRecall: Run popular Volatility commands and generate a report
• WIPSTER Installer: Install web interface for MASTIFF and other tools
• RATDecoders: Extract and decode configuration details from common RAT samples

Selain tool2 baru yang dipasang seperti di atas, REMnux v5 yang terbaru juga menambah tool lain untuk komponen inti OS serta berbagai utilitas lain yang hadir dalam versi sebelumnya dari distro, termasuk Volatilitas, peepdf, Jaringan Miner, OfficeMalScanner, mastiff, ProcDOT dan lain-lain. Untuk daftar lengkap dari alat REMnux v5, lihat spreadsheet XLSX .

sumber