Static malware analysis inside an ephemeral REMnux Docker container. The sample is never executed — all tooling runs in an isolated, network-disabled container. Results are scored, IOCs extracted, and a Markdown report written automatically.
docker pull remnux/remnux-distro
git clone https://github.com/KrakoX/remnux-malware-analysis
cd remnux-malware-analysis
python analyze.py /path/to/sample.exeNo Python dependencies — stdlib only. YARA rules download automatically on first run.
- Detect — spin up a fresh REMnux container, stage the sample, collect hashes and file type
- Preprocess — decompress or decrypt if needed (PDF, encrypted Office documents)
- Run — execute tools matched to the file category and chosen depth
- Unpack — for archives, extract inner files and analyse each independently
- Report — score findings, extract IOCs, query VirusTotal (optional), write a Markdown report
Container flags: --network none, --cap-drop ALL, --memory 2g, --pids-limit 256.
python analyze.py sample.exe # standard depth
python analyze.py sample.exe --depth deep # full tool suite
python analyze.py sample.exe --output-dir ./reports| Depth | Tools |
|---|---|
quick |
hashes, file type, entropy, packer detection |
standard (default) |
+ strings, YARA, format-specific tools (olevba, pdf-parser, etc.) |
deep |
+ capa, manalyze, deobfuscators |
pe · elf · pdf · ole2 · ooxml · rtf · archive · script · pyc · onenote · email · shellcode · unknown
Downloaded automatically on first run, cached at ~/.local/share/yara-rules/, refreshed every 7 days:
- Neo23x0/signature-base — 700+ rules
- malpedia/signator-rules — 1600+ rules
Set VIRUSTOTAL_API_KEY in your environment:
export VIRUSTOTAL_API_KEY=your_key_hereOr create a config file at the project root (gitignored):
[virustotal]
api_key = YOUR_KEY_HEREGet a free key at virustotal.com. Adds detection count, threat label, first-seen date, and community YARA matches to the report.
See CONTRIBUTING.md for setup, testing, and PR guidelines.
To clean up containers left over after a failed run:
docker ps -a --filter "name=remnux-analysis" --format "{{.ID}}" | xargs docker rm -fSee ARCHITECTURE.md for internals.