REMnux keyboard and mouse image

REMnux: A Linux Toolkit for Malware Analysis

REMnux® is a Linux toolkit for reverse-engineering and analyzing malicious software. REMnux provides a curated collection of free tools created by the community. Analysts can use it to investigate malware hands-on or by directing AI agents, without having to find, install, and configure the tools. The REMnux MCP server provides those agents with guidance on which tools to run and how to interpret the results.

REMnux keyboard and mouse image

Get the REMnux Distro

Download the REMnux VM

Download the REMnux VM

The easiest way to get the REMnux distro is to download the REMnux virtual machine, then import it into your hypervisor.

Download

Add REMnux to a System

You can also install the distro from scratch on a dedicated host or add it to an existing system running a compatible version of Ubuntu.

Instructions
Add REMnux to a System
Profile Picture

Containers

The REMnux toolkit also offers Docker images of popular malware analysis tools, making it possible to run the them as containers without having to install the tools directly on the system. You can even run the REMnux distro as a container.

Details

People

From 2010
Lenny Zeltser
Founder, Primary Maintainer
From 2020
Corey Forman
Contributor
From 2017
Erik Kristensen
Architect, Advisor
Throughout Epoch Time
Tool Authors
Community Members
Profile Picture

Documentation

For details about installing, using, and contributing to REMnux, as well as for information about the tools included in the toolkit, see the REMnux documentation site.

Read

Frequently Asked Questions

What is REMnux?
REMnux is a free Linux toolkit for reverse-engineering and analyzing malicious software. It includes hundreds of community-created tools in one Ubuntu-based toolkit, so analysts can examine malware without finding, installing, and configuring each tool themselves.
How do I get REMnux?
Download the REMnux virtual appliance and import it into your hypervisor. You can also install REMnux on a fresh Ubuntu system, add it to one you already use, launch it on AWS, or run it as a Docker container.
Is there a REMnux ISO?
No. REMnux is available as a virtual appliance and as an installer for Ubuntu. You can also add REMnux to an existing system based on a compatible version of Ubuntu.
What is the default password?
On a default REMnux installation, the username is "remnux" and the password is "malware".
Does REMnux run on Apple M-series Macs?
Yes. REMnux has arm64 builds for Apple M-series Macs and other ARM systems. A few tools run only on Intel and AMD systems, and the documentation lists an alternative for each.
How do I update REMnux?
Run "remnux install". The command updates the REMnux tools and the operating system, and the same command installs REMnux on a new system.
Can AI agents use REMnux?
Yes. The REMnux MCP server lets AI assistants run the toolkit's tools and interpret their results.
How is REMnux licensed?
REMnux is free. The code and configuration behind the toolkit are licensed under the GNU GPL v3.0, and each tool has its own license.