Tag: digital-forensics

Enhancing Malware Analysis with REMnux and AI

DFIR, Forensics, Malware, REMnux

Those familiar with my work know that I’m a big fan of the REMnux Linux distribution for malware analysis. When I developed MalChela, I included a custom configuration that can be invoked that not only includes the MalChela tool suite but also integrates many of the CLI tools installed in REMnux, providing an easy-to-use GUI.

Recently, a new REMnux release was released on Ubuntu 24.04. This was a welcome upgrade because REMnux was previously locked to 20.04, which was becoming outdated. As soon as I noticed the release announcement, I downloaded the latest version and installed the MalChela suite. Everything ran smoothly, and the GUI interface even appeared slightly sharper without any changes on my part.

While reviewing the release notes for the new version, I discovered that REMnux now includes integration with Opencode AI. In REMnux, several models are preconfigured to recognize the tools included in the distribution and their capabilities and syntax. You can use natural language prompts, and the system will interpret the request, execute the appropriate tools against the file, and provide a summary of the results. As mentioned in the documentation:

The AI uses the REMnux MCP server to run the appropriate REMnux tools automatically. The MCP server offers guidance regarding the tools that the AI should consider, but it’s up to the AI agent to decide on the analysis workflow. And, of course, your interactions, requests, and observations can also direct the AI regarding the analysis steps.

Key capabilities available to AI assistants through the REMnux MCP server:

  • Analyze files based on detected type (PE, PDF, Office docs, scripts, ELF, etc.)
  • Get tool recommendations for a specific file without running them
  • Run specific REMnux tools directly, including piped commands
  • Extract indicators of compromise (IOCs) from text
  • Get usage help for any installed REMnux tool

I experimented with a few of the usual suspects in my corpus and provided pretty generic prompts like “analyze (file-xyz)” and “what are the IOCs?” The results were very positive – but I’ve only scratched the surface in testing.

Then I decided to see how adaptive this AI was and how easy it would be to make it aware of new tools and syntax. I provided the following:


MalChela tool suite is  installed in /home/remnux/Tools/MalChela
All are rust based tools so cd to the MalChela directory, and then ./target/release/fileanalyzer (path to executable) would be the syntax. 
The 4 tools below are the primary tools for static analysis.
  File Analyzer       |  Get the hash, entropy, packing, PE info, YARA and VT match status for a file  
  mStrings            |  Analyzes files with Sigma rules (YAML), extracts strings, matches ReGex. 
  NSRL Hash Lookup    |  Query an MD5 or SHA1 hash against NSRL
  Malware Hash Lookup |  Query a hash value against VirusTotal & Malware Bazaar 

Immediately it began running the tools in MalChela against the malware file I was previously analyzing and provided a summary of the different tool results.

I plan to do a lot more testing but so far things are looking very promising.

So what do you think? Are you using AI in your malware analysis workflows? What capabilities of AI do you think are most useful when it comes to malware analysis? Let me know in the comments.

Toby-Find: Simplifying Command-Line Forensics Tools

DFIR, Forensics, Malware, Memory Analysis, Raspberry Pi, Triage

In digital forensics, we often take a toolbox approach — success hinges on having the right tool for the job. Some tools offer broad functionality, while others are deeply specialized. Distributions like KALI and REMnux do a fantastic job bundling a wide range of forensic and security tools, but keeping track of what’s actually installed can be a challenge.

If you’re using a graphical interface, browsing through available packages is fairly intuitive. But when you’re living in the terminal — as many analysts do — that discoverability disappears. There’s no built-in index of command-line tools or how to invoke them.

The first version of Toby-Find was born out of necessity. I teach a Network Forensics course at the university, using a custom VM loaded with tools like Zeek, Tshark, Suricata, and more. I wanted students to have an easy, searchable way to see what CLI tools were available and how to run them — without needing to memorize commands or dig through man pages.

Later, when I built Toby (a forensic-focused Raspberry Pi rig running a customized KALI install), I updated Toby-Find to include the complete CLI toolset geared toward forensics and malware analysis from the KALI ecosystem.

And because I can’t leave well enough alone, I decided to build a REMnux-compatible version too.

⸻

Once installed, you can launch Toby-Find (via tf, toby-find, or tf-help) from any terminal and instantly search for tools, descriptions, examples, and more.

Toby-Find on REMnux
Toby-Find on Kali

⸻

📦 Installation

1. Clone the repository:

git clone https://github.com/dwmetz/Toby.git

2. Make the install script executable:

cd Toby
chmod +x install.sh

3. Run the installer:

./install.sh

4. Follow the prompt to choose your environment (KALI or REMnux)
5. Open a new terminal or run:

source ~/.bashrc   # or ~/.zshrc depending on shell

🚀 Usage

tf [keyword]

Examples:

tf yara
tf volatility
tf hash

To view the full list:

tf-help

Whether you’re working from a custom VM, a rugged Pi, or a hardened REMnux box, Toby-Find gives you a fast, terminal-friendly way to surface the tools at your disposal — without breaking focus. It’s lightweight, portable, and easy to extend for your own lab or classroom.

You can grab the full installer from GitHub, and contributions are always welcome. If you find it helpful — or build on it — I’d love to hear about it.