Sheet 1
REMnux v5
Tools
  Examine browser malware
    Websites
      Thug
      mitmproxy
      Network Miner Free Edition
      curl
      Wget
      Firefox
        QuickJava
        Tamper Data
      Burp Proxy Free Edition
      Automater
      pdnstool
      Malzilla
      Tor
    Flash
      xxxswf
      SWF Tools
      RABCDAsm
      extract_swf
    Java
      Java Cache IDX Parser
      Java Decompiler
    JavaScript
      Rhino Debugger
      JSDetox
      ExtractScripts
      Firebug
      JavaScript Deobfuscator
      def.js
      SpiderMonkey
      V8
      JS Beautifier
  Examine document files
    PDF
      AnalyzePDF
      JSDetox
      Pdfobjflow
      pdfid
      pdf-parser
      peepdf
      Origami
      PDF X-RAY Lite
      PDFtk
    Microsoft Office
      officeparser
      OfficeMalScanner
    Shellcode
      sctest
      unicode2hex-escaped
      unicode2raw
      dism-this
  Extract and decode artifacts
    Deobfuscate
      unXOR
      XORStrings
      ex_pe_xor
      XORSearch
      brutexor/iheartxor
      xortool
      NoMoreXOR
      XORBruteForcer
      Balbuzard
    Extract strings
      strdeobj
      pestr
      strings
    Carving
      Foremost
      Scalpel
      bulk_extractor
      Hachoir
  Handle network interactions
    Sniffing
      Wireshark
      ngrep
      TCPDump
      tcpick
    Services
      FakeDNS
      Tiny HTTPd
      fakeMail
      Honeyd
      INetSim
      Inspire IRCd
      OpenSSH
    Miscellaneous network
      prettyping.sh
      set-static-ip
      renew-dhcp
      Netcat
      EPIC IRC Client
      stunnel
  Process multiple samples
    Maltrieve
    Ragpicker
    Viper
    MASTIFF
    WIPSTER Installer
    Density Scout
  Examine file properties and contents
    Define signatures
      YaraGenerator
      Yara Editor
      IOCextractor
      Autorule
    Scan
      Yara
      ClamAV
      TrID
      ExifTool
    Hashes
      nsrllookup
      Automater
      Hash Identifier
      totalhash
      ssdeep
  Investigate Linux malware
    System
      Sysdig
      Unhide
    Disassemble
      Vivisect
      Udis86
      objdump
    Debug
      Evan's Debugger (EDB)
      GNU Project Debugger (GDB)
    Trace
      strace
      ltrace
    Investigate
      Radare 2
      Pyew
      Bokken
  Edit and view files
    Text
      SciTE
    Images
      feh
      ImageMagick
    Binary
      wxHexEditor
      VBinDiff
    Documents
      Xpdf
      XMind
  Examine memory snapshots
    Volatility Framework
    TotalRecall
    findaes
    AESKeyFinder
    RSAKeyFinder
  Other tasks
    ProcDOT
    bashhacks
    Androwarn
  Statically examine PE files
    Unpacking
      UPX
      Bytehist
      Density Scout
      PackerID
    Disassemble
      objdump
      Udis86
      Vivisect
    Find anomalies
      Signsrch
      pescanner
      ExeScan
      pev
      Peframe
    Investigate
      Bokken
      RATDecoders
      Pyew
cd /usr/local/thug/src && ./thug.py
Honeyclient for investigating suspicios websites
mitmproxy, mitmdump
Intercept, modify, replay and save HTTP and HTTPS traffic
NetworkMiner
Examine network traffic and carve PCAP capture files
curl
Command-line tool for retrieving website contents
wget
Command-line tool for retrieving website contents
firefox
Web browser
firefox, QJ button
Toggle Firefox' support for risky web contents
firefox, Tools, Tamper Data
View and modify HTTP/HTTPS headers and post parameters.
burpsuite
Analyze and interact with websites in a controlled manner
cd /usr/local/Automater && ./Automater.py
Look up URL/Domain, IP and MD5 hash details
pdnstool
Perform passive DNS lookups
malzilla
Analyze suspicious websites and decode JavaScript
tor start, usewithtor, twget
Tools for directing network traffic through anonymizing proxies
xxxswf.py
Extract Flash objects from other files
swfdump, swfextract, swfstrings, etc.
A toolkit for examining, creating and modifying Flash files
rabcdasm, abcexport
Examine ActionScript from Flash files
extract_swf.py
Extract Flash object from files
idx_parser.py
Examine Java IDX files
jd-gui
Decompile Java class files
rhino-debugger
Standalone JavaScript debugger
cd /usr/local/jsdetox && ./jsdetox && firefox http://127.0.0.1:3000
Decode obfuscated JavaScript
extractscripts
Extract JavaScript scripts from an HTML file
firefox, F12
JavaScript debugger for Firefox
firefox, Tools, Web Developer, JavaScript Deobfuscator
Observe JavaScript scripts being executed by Firefox
js -f /usr/local/etc/def.js
Library of JavaScript objects commonly defined by a browser or a PDF reader
js
JavaScript engine from Mozilla
d8
JavaScript engine from Google
js-beautify
Reformat JavaScript scripts to improve their readability
cd /usr/local/AnalyzePDF && ./AnalyzePDF.py
Examine a malicious PDF file
cd /usr/local/jsdetox && ./jsdetox && firefox http://127.0.0.1:3000
Decode obfuscated JavaScript
pdf-parser.py | pdfobjflow.py
Reads the output from pdf-parser and creates the map of the objects flows under the form of a DOT file
pdfid.py
Locate common suspicious artifacts in a PDF file
pdf-parser.py
Examine a suspicious PDF file
peepdf
Analyze suspicious PDF files
pdfwalker, pdfextract, pdfcop, etc.
Framework for examining, creating and modifying PDF files
pdfxray_lite
Examine the PDF document structure and contents
pdftk
Edit PDF files
officeparser.py
Extract embedded files and macros from office documents
OfficeMalScanner
Examine suspicious Microsoft Office files
sctest
Emulate shellcode execution
unicode2hex-escaped
Clean up and convert Unicode to hex
unicode2raw
Clean up and convert Unicode to raw
dism-this.py
Analyze disassembled data within file objects
unxor.py
Guess a XOR key via known-plaintext attacks
xorstrings
Locate and decode XOR-obfuscated strings
ex_pe_xor.py
Carve out single-byte XOR encoded executables from files
xorsearch
Locate and decode strings obfuscated using common techniques
brutexor.py
Bruteforce all possible 1-byte XOR key values and examine the file for strings that might have been encoded with these keys
xortool
Locate and deobuscate contents encoded using a multi-byte XOR cipher
NoMoreXOR.py
Guess 256-byte XOR keys by using frequency analysis
xorBruteForcer.py
/usr/local/balbuzard/balbuzard.py
/usr/local/balbuzard/bbcrack.py
/usr/local/balbuzard/bbharvest.py
/usr/local/balbuzard/bbtrans.py
Extract and decode suspicious patterns from malicious files
strdeobj
Extract and decode strings defined as arrays
foremost
Carve contents of files
scalpel
Carve contents of files
bulk_extractor
Scan a disk image, a file, or a directory of files and extracts useful information
hachoir-subfile, hachoir-metadata, hachoir-urwid
View, edit and carve contents of various binary file types
wireshark
Network sniffer
Sniff the network while looking for patterns that match the specified regular expressions
tcpdump
Command-line network sniffer
tcpick
Sniffer that reassembles TCP streams
fakedns
Respond to DNS queries with a specified IP address
httpd start
A simple web server that supports HTTP
fakemail
Fake mail server that captures emails messages sent through it without retransmitting them
farpd start && honeyd start
Intercept network traffic and emulate common services
inetsim
Emulate common network services
ircd start
IRC server
sshd start
SSH server
pping
Ping a host while looking pretty
set-static-ip
Temporarily assign a static IP
renew-dhcp
Refresh DHCP client details assigned to the local system
nc
Flexible network client and server
irc
IRC client
stunnel
SSL encryption wrapper
maltrieve.py
Retrieve malware from malicious sites
cd /usr/local/MalwareCrawler/src && ./ragpicker.py
Malware crawler with pre-analysis and reporting functionality
viper
Store, classify and investigate suspicious binary files
mas
/usr/local/sbin/install-wipster
Install web interface for MASTIFF and other tools
densityscout
Calculates density (like entropy) of files in the specified location, useful for finding packed programs
yaraGenerator.py
Generate Yara rules for designated files
yara-editor
Create and modify Yara rules
IOCextractor
Extract IOCs from a text report file
cd /usr/local/autorule && ./tester.py
Automatically define Yara signatures for a set of files
yara
Scan files and file system for signatures
clamscan
Clam antivirus engine
trid
Identify file types
exiftool
Extract file properties
nsrllookup
Look up file hashes on an NSRL database server
cd /usr/local/Automater && ./Automater.py
Look up URL/Domain, IP and MD5 hash details
hash_id
Identify the different types of hashes used to encrypt data and especially passwords
totalhash.py
Look up a suspicious file hash in the totalhash.com database
ssdeep
Define and scan for a "fuzzy" signature of a file
sysdig
Track and examine local system activities on a Linux system
Find local hidden processes or connections on a Linux system
vivbin
Statically examine and emulate binary files
udcli
Disassemble binary files
objdump
Disassemble binary files
edb
Debug EFL binary files
gdb
A powerful debugger
strace
Trace system calls and signals
ltrace
Trace library calls
radare2
Framework for examining binary files
pyew
Statically examine suspicious files
Interactive static malware analysis tool
scite
Simple, yet powerful text editor
feh
Image viewer
display
Image viewer
vbindiff
Compare binary files
xpdf
PDF file viewer
xmind
Mind-mapping tool for organizing thoughts and data
vol
Memory forensics tool and framework
cd /usr/local/TotalRecall && ./TotalRecall.py
Run popular Volatility commands and generate a report
findaes
Locate embedded AES keys
aeskeyfind
Locate embedded AES keys
rsakeyfind
Locate embedded RSA keys
procdot
Visualize and examine the output of Process Monitor and network sniffer logs
source /usr/local/bashhacks/bashhacks.sh
Useful bash shell functions
androwarn.py
Android static code analyzer
upx
A popular tool for packing and unpacking executable files
bytehist
Generate byte-usage-histograms for all types of files with a focus PE files
densityscout
Calculates density (like entropy) of files in the specified location, useful for finding packed programs
packerid
Help determine which packer was used to protect a PE file
objdump
Disassemble binary files
udcli
Disassemble binary files
vivbin
Statically examine and emulate binary files
signsrch
Locate common code patterns
pescanner
Statically examine a PE file and detect suspicious characteristics
exescan.py
Statically examine a PE file and detect suspicious characteristics
pepack, pescan, pestr, pehash, readpe, etc.
PE file analysis toolkit
cd /usr/local/peframe && ./peframe.py
Statically examine PE files
Interactive static malware analysis tool
cd /usr/local/RATDecoders && ls
Extract and decode configuration details from common RAT samples
pyew
Statically examine suspicious files