tcpflow

TCPFLOW 1.5.0 Downloads directory: http://digitalcorpora.org/downloads/tcpflow/ Installation Most common GNU/Linux distributions ship tcpflow in their repositories. So on Debian/Ubuntu/etc you can say root@kitploit: sudo apt-get install tcpflow and on Fedora/RedHat/CentOS/etc you can say...

distro

REMnux 发行版仓库 此仓库包含 REMnux 发行版的补充文件，以及该发行版从 Launchpad 上的 REMnux 软件包仓库 安装的 Debian 软件包的源文件。 仓库结构 files/ REMnux 发行版使用的补充文件，包括： 安装期间部署的辅助脚本和实用工具 为增强韧性而保留的依赖项镜像副本 ppasrc/ 发布到 REMnux PPA 的 Debian 软件包的源包。每个子目录包含特定工具的打包文件，按 Ubuntu 发行版（Bionic、Focal、Noble）组织。 相关资源 REMnux 官网 REMnux 文档 Salt States 仓库 –...

Office-Malware-Forensics-Lab-REMnux-Static-Analysis

Office Malware Forensics Lab — REMnux Static Analysis Static analysis of two malicious Office files, done entirely inside an isolated REMnux VM. Nothing was ever executed — just inspected. Setup REMnux VM, no shared folders with the host Tools: sha256sum, file, unzip, and the oletools suite oleid...

windows-malware-behavioral-analysis

使用 REMnux 与 FLARE-VM 进行恶意软件行为分析 一个实用的蓝队恶意软件调查项目，演示如何利用行为分析技术在隔离的实验室内安全地分析可疑的 Windows 可执行文件。 与对恶意软件源代码进行逆向工程不同，本项目侧重于观察运行时行为、收集主机与网络遥测数据、提取入侵指标（IOC），并将攻击者活动映射到 MITRE ATT&CK 框架。 目标 构建安全的恶意软件分析实验室 观察恶意软件执行期间的行为 监控 Windows 主机活动 捕获恶意网络流量 识别持久化机制 提取入侵指标（IOC） 将调查结果映射到 MITRE ATT&CK 挖掘检测机会 调查工作流程 阶段 1 —...

Introducing Linux Support for FakeNet-NG: FLARE’s Next Generation Dynamic Network Analysis Tool

Introduction In 2016, FLARE introduced FakeNet-NG, an open-source network analysis tool written in Python. FakeNet-NG allows security analysts to observe and interact with network applications using standard or custom protocols on a single Windows host, which is especially useful for malware...

Introducing Linux Support for FakeNet-NG: FLARE’s Next Generation Dynamic Network Analysis Tool

Introduction In 2016, FLARE introduced FakeNet-NG, an open-source network analysis tool written in Python. FakeNet-NG allows security analysts to observe and interact with network applications using standard or custom protocols on a single Windows host, which is especially useful for malware...

Introducing Linux Support for FakeNet-NG: FLARE’s Next Generation Dynamic Network Analysis Tool

Introduction In 2016, FLARE introduced FakeNet-NG, an open-source network analysis tool written in Python. FakeNet-NG allows security analysts to observe and interact with network applications using standard or custom protocols on a single Windows host, which is especially useful for malware...

Reverse Engineering Malicious Software: REMnux Distro

REMnux v6 – A Linux Toolkit for Reverse-Engineering and Analyzing Malware – has been released. REMnux v6 updates the tools that were present in the earlier revisions of the distro and introduces several new ones. Moreover, it implements major architectural changes behind the scenes to allow REMnu...

[REMnux] A Linux Distribution for Malware Analysis

REMnux incorporates a number of tools for analyzing malicious executables that run on Microsoft Windows, as well as browser-based malware, such as Flash programs and obfuscated JavaScript. This popular toolkit includes programs for analyzing malicious documents, such PDF files, and utilities for...

New Version of REMnux Malware-Analysis Linux Distribution Released

A new version of the REMnux specialized Linux distribution has been released, and it now includes a group of new tools for reverse-engineering malware. The new additions include a tool for memory forensics as well as one for analyzing potentially malicious PDFs. REMnux was first released last yea...

REMnux: A Linux Distribution for Reverse-Engineering Malware

REMnux: A Linux Distribution for Reverse-Engineering Malware REMnux is a lightweight Linux distribution for assisting malware analysts in reverse-engineering malicious software. The distribution is based on Ubuntu and is maintained by Lenny Zeltser. REMnux is designed for running services that ar...

New Linux OS REMnux Designed For Reverse Engineering Malware

A security expert has released a stripped-down Ubuntu distribution designed specifically for reverse-engineering malware. The OS, called REMnux, includes a slew of popular malware-analysis, network monitoring and memory forensics tools the comprise a very powerful environment for taking apart...