REMnux Installation

• REMnux Installation
  • Step 1: Install Ubuntu 24.04
  • Step 2: Get the REMnux Installer
  • Step 3: Run the REMnux Installer
  • Step 4: Reboot
  • Step 5: Review Hypervisor-Specific Configuration
  • Step 6: Take a Snapshot
  • Keeping REMnux Up to Date

REMnux is a Linux distribution purpose-built for malware analysis. It ships with hundreds of pre-configured tools for static analysis, dynamic analysis, reverse engineering, memory forensics, and network interaction examination. It is our primary analysis environment for this course.

Architecture note: REMnux is based on an x86/amd64 version of Ubuntu and will not run fully on ARM processors such as Apple’s M-series chips (specifically, WINE will not install or function). Mac users with Apple Silicon will need to run REMnux in a cloud VM or on a separate x86 machine to obtain such functionality.

Full documentation: docs.remnux.org

Step 1: Install Ubuntu 24.04

REMnux installs on top of a minimal Ubuntu 24.04 Server base. Download the 64-bit Ubuntu 24.04 Server ISO that matches your architecture from the Ubuntu releases page.

Install Ubuntu using the downloaded ISO, following these choices:

• Boot from the ISO and select “Try or Install Ubuntu Server”
• Select your language and keyboard layout
• When prompted for installation type, select “Ubuntu Server (minimized)”
• Configure networking — DHCP is fine for most lab setups
• Skip proxy configuration unless your network requires it
• Accept the default Ubuntu archive mirror
• When configuring storage, uncheck “Set up this disk as an LVM group” to use a simpler partition layout

• At the profile setup screen, use the following to stay consistent with the default REMnux configuration:

  Field	Value
  Your name	REMnux User
  Server’s name	remnux
  Username	remnux
  Password	malware

• Skip Ubuntu Pro setup
• Skip OpenSSH server unless you need remote access
• Do not select any additional snaps
• Wait for the installation to complete, then reboot

Log in at the command prompt with the credentials above.

Note: You do not need to update the OS or packages separately — the REMnux installer handles that automatically.

Step 2: Get the REMnux Installer

Download the REMnux installer:

curl -O https://REMnux.org/remnux

Verify the SHA-256 checksum of the downloaded file against the value listed on the REMnux releases page:

sha256sum remnux

Note: The expected checksum changes with each REMnux release. Always compare against the value published on the official releases page rather than any hardcoded value in course materials.

Set up the installer:

chmod +x remnux
sudo mv remnux /usr/local/bin

Step 3: Run the REMnux Installer

For a local lab installation (standard — use this for class):

sudo remnux install

For a remote cloud environment where you need SSH access to remain enabled:

sudo remnux install --mode=cloud

The installation takes roughly an hour depending on your resources and internet connection.

If the installer produces an error, check what failed:

remnux results

This shows installation results and highlights any failures.

Step 4: Reboot

sudo reboot

After rebooting, REMnux will automatically log you in — there is no login screen, since analysts typically use REMnux on a physically restricted system.

Step 5: Review Hypervisor-Specific Configuration

Depending on your hypervisor (UTM, VirtualBox, VMware, etc.), you may need a few configuration tweaks. Review the Special Hypervisor Requirements before considering the installation complete.

Step 6: Take a Snapshot

Take a VM snapshot now, before you do any analysis work, so you can restore to a clean known-good state at any time. In UTM, right-click the VM and select Save State.

Keeping REMnux Up to Date

Run the following periodically to update all REMnux tools:

sudo remnux upgrade

See the Keep the Distro Up to Date documentation for details.