Environment Configuration

• Environment Configuration
  • Getting REMnux
  • System Configuration
    • Install Additional Tools
  • Important: VM Snapshots

REMnux is a Linux toolkit for reverse-engineering and analyzing malicious software, maintained by Lenny Zeltser. It is distributed as a pre-built Ubuntu-based VM with a curated collection of malware analysis tools already installed and configured. This is our primary analysis environment for this course.

Getting REMnux

The simplest way that works everywhere is to follow these instructions.

System Configuration

First, make sure REMnux is up to date:

$ sudo apt update
$ sudo apt upgrade -y

Install Additional Tools

REMnux comes with many malware analysis tools pre-installed. The script provided for this course installs supplemental tools not included in the base image. Run it with:

$ curl -LO https://web.cecs.pdx.edu/~dmcgrath/courses/malware/setup.sh
$ chmod +x setup.sh
$ # edit the script to fill in the missing pieces near the bottom
$ ./setup.sh

This will take a while. When it’s done, reboot your VM to ensure everything is set up correctly, then log back in and launch a terminal.

a

Important: VM Snapshots

Before you begin any malware analysis, take a VM snapshot. This allows you to revert to a clean state at any time. In VirtualBox:

1. Go to Machine > Take Snapshot
2. Give it a descriptive name (e.g., “Clean baseline - post setup”)
3. Before each assignment, revert to this snapshot or take a new one

Never execute malware outside your VM. If in doubt, revert to a clean snapshot.