Build your own AI Malware Analysis Lab with Remnux

Welcome to malware analysis for hedgehogs. Two weeks ago, I published an article on the data tech blog about using large language models AI for malware analysis. In my opinion, they are a great tool in the malware analyst's arsenal. Uh they can cut down your analysis time short in a very significant way. But, you need to know how to use them properly. Since I published this article, a lot of people asked me how they can set up their own analysis lab with an AI. And today, I'm going to show you how to do that. And we will do that today for the static analysis system. And I will publish a second video where we go over the dynamic analysis system. So, what do you need before you even start? I highly recommend, actually I insist that you have a system that's dedicated for malware analysis only. So, if you have a very old laptop or computer somewhere, get that one and then repurpose it for malware analysis only. Get rid of any personal data that's on that system, um reformat it, and then install Linux as your host. I'm assuming here that we analyze Windows malware. So, install some Linux distro as your host and then get VirtualBox. Your analysis system should have at least 16 GB RAM, given that we also want to perform dynamic analysis at some point. And then you need at least run uh two virtual machines at once. Next, I highly recommend also that you get a VPN, a good one. And set this up on the analysis machine. Simply because it's very easy on accident that you allow your large language model to download stuff from a malicious server. And in that case, it's better you connect with a VPN than without. If you have any questions about this setup, please feel free to join our Discord server. I will put the invite link in the description below. And if you're interested in learning malware analysis, check out my courses. They are also in the description below. So, the first step that you need to do is you go to remnux.org and you download the virtual appliance file. So, we go here to the download section. It's first step, you will see three um virtual appliance options. I'm going to go with virtual box OVA because I'm using virtual box. Let's download that and wait until it's finished. By the way, you may notice that this is a Windows system right here. I only use this machine for recording videos. I don't generally use it for malware analysis, so just in case you're wondering, the steps are the same even if you have a different host system. Next, you open Oracle VirtualBox Manager. You go to file, import appliance, and search for the file that you just downloaded. So, we open the OVA file. Click finish. And now you just need to wait a little until import is done. So, let's now start the VM. >> And here we are. It may happen that you have a low-resolution screen here or very small text. Um in that case, you need to change a few things here like resize this, uh put this to auto scale so that you get a little bit bigger text, for instance. And um once you have done this, that sounds good. I think we should do this just now. Let's upgrade guest additions. Next, we are going to upgrade Remnux. Ouch. We are done. It tells us to reboot. So, let's do just that. Now, we want to install Claude. I tested various versions of Claude and ChatGPT, and I found Claude to be a little bit better for my use cases. To do that, we run curl speed me download the install script from Claude AI, and then we execute it. So, it's telling us to add local bin to our path. Let's do just that. Can just copy and paste this here, press the middle mouse button, and then you have it pasted. And this will uh make the path available. Now, we need to start Cloud. We have now a few options that we can choose. Let's stick with dark mode. And now it depends what kind of payment option you want to use. My recommendation is if you just want to test around a little bit, you can use API usage billing. However, this gets very expensive very quickly. So, as soon as you do this more regularly, switch to subscription because that's way less expensive than the other one. So, I'm just going to authenticate here. If you successfully logged in, you can press enter. You get the screen. And that is basically now you can start using Cloud. Let me say no exit because I actually want to use a specific project folder and not my home. Now, let's install REMnux MCP. You will find that here on GitHub REMnux REMnux MCP server. And you will see there are three scenarios how to set it up. The one we use is the second. So, we have one VM where the AI assistant is and where the MCP server is. I found that to be the best solution for my use case. Um the problem with the Docker one is that Docker is not really a good security boundary for analyzing malicious code. Um [snorts] so, I first my first test I had this on my host machine, the AI assistant, and then uh Docker for the analysis stuff. And then I figured, "Okay, it's probably not the best solution, right?" So, let's set this up. Let's create a dedicated folder for analysis and run Cloud, and we say yes, we trust this folder. And we can now actually tell Cloud to install REMnux MCP. We already see a small problem here. The user interface is using Unicode symbols, which are not supported by the font that we currently use on REMnux, but we will fix this soon. So, we confirm you want scenario two. See here, we are running it directly on REMnux, so we have scenario two. I will install it using Cloud MCP add with local mode. And yep, that's what we going to do. It will need NPM to do that. And now it adds the MCP server. And now it tells you that the server will be available in our next conversation. So, let's exit. And one thing we need to do, we need to create those directories, otherwise uh at least when I tried it had some issues because they weren't there. So, let's create them. Go back to the analysis directory. Let's now fix the font issue. So, it looks like the font Noto Mono is already installed and already on the newest version. So, I'm right-clicking. I think it worked with right-clicking. Oh, yeah. Right-click on the black part here. Go to preferences, and then we will change the font. Say custom font and choose Noto Mono. This one. Select this. Run Cload. Let's test our MCP server, shall we? First thing, we verify it's there. So, if you do {slash} MCP, you now can see that Remnux is connected. However, we need another MCP server, which is Remnux Docs. That's because Remnux or because your AI needs to know how to use the tools. And we see your optional for additional tool documentation. You can enable this one alongside. Okay. It doesn't doesn't lead anywhere, but let's just ask Cload to install it as well. And it seems the font issue is still not solved, but yeah. Let's get back to that later. Okay. Yeah, I didn't continue with the previous session. So, now it adds Remnux Docs. Verify it's the correct address. So, and now we excel again. Just this time when we run Claude say continue so that it remembers your last conversation, which it didn't in this case because I forgot to do that. Uh and now we can check MC P again and now we also have the docs connected. And what this does is Claude now has the instructions and the tools and the documentation how to use these tools. And at this point you already have a solid static analysis lab where the AI can autonomously analyze sample. So let's get back to our analysis directory, run Claude, and see test a little bit uh our new malware analysis lab. To get samples onto your machine, you may want to set up a shared folder. And uh for that we I think that was here, devices, shared folders, shared folder settings. And you add another shared folder. Now it depends what you want to do. If you want to get samples onto the machine, it is safest to turn on read only so that nothing can write onto this location since you share the shared folder with your host system. So let's name it malware. And let's select any path that you want to use for that. So I have chosen a path. We can now make this permanent and auto mount and say okay. And um press okay. The next thing we need to do is we need to obtain permissions to access the samples folder. So By adding the user to the group VBoxSF, we have now permissions to access them. But this only works if we log out and log in again. So let's just reboot the system. So I just realized that the font issue is still not fixed. So I'm guessing we not only need the fonts not to color emoji, but also fonts not to extra. Let's see if that fixes it. Because yeah, I fixed it on my actual system that I use for analysis and I don't really remember how. So let's see if that was the case with this one here. No. Actually no. Let's go to the analysis folder, open cloud. Here no, but And we can see here this again this issue. And it's only certain symbols that are affected. Let me see if it works if I just restart the terminal. >> And now we can see it here. Yeah. It's visible. Okay, that might have fixed it. Let's see if we have access to the folder. And it works. I already put some files in there, so I can see that stuff works like that. Yeah, now let's make this a little bit more convenient. We want to mount this folder into the workspace of file samples, which is what REMnux uses to search for samples. So, Oh, wait. I need to add sudo this. And now we have the files there, and everything works fine. So, now let's test if REMnux MCP works, and we are going to analyze the first file here. Let's see which files we have available. It's now using the list files command. And yes, we will allow reading the shared folder in general, so that we don't have to agree every time it does this. >> The upload from host loads or basically just copies the file into the samples directory. Because the Remember the shared mounted folder is read-only. And if it attempts to analyze the files there, it runs into troubles because it wants to extract those folders, right? So here's one thing I generally work with archives that are password protected. Now if I tell it to extract those archives or just tell it to analyze the samples, it will try to brute force the archives. Not a good idea. If this is a a thing that you do all the time, um you may want to tell ClamAV that every archive after upload should be extracted with the infected password. And to do this, we added the ClamAV file so that Go there. See, it's not available. So we just create it. And I will say um always Always extract archives with infected password after upload. We run ClamAV continue because we logged out of the session and now log in again, it will read cloud and D. Now I'm going to say just please analyze this file. Let's see what it comes up with. And you can see now it exactly knows that it has to use the infected password. And also I will allow in general to extract archives because it's safe. And now it wants to run the analyzed file command of Remnux MCP. And yes, we will do that. And it's also something we can generally allow to do. Run tool is something you don't want to allow generally because it can do everything on the system. So. And now we got our report. So it tells us, "Hey, this has a remote template injection high risk. Uh there is an attached template in this file. And it uh connects to this site here. So that was a very simple file, which is why this worked very fast. Now here are a few tips from me how to use this analysis system properly. The first thing I do is I added a skill for writing reports. And a good way to add this skill is basically to guide an analysis session and then tell it to put everything that we did into a skill. So, I can tell it, "Hey, um write a markdown report about this file." And one thing that I find very useful is So, a lot of the stuff that the AI figures out might be wrong. So, like 20% of what you find in in as an as a response here might be wrong. So, these numbers might be slightly wrong or file passes might be wrong. And yeah, even URLs like this might be slightly wrong. So, to use this as a proper analysis tool reliably, you want it to generate steps how you can yourself verify that things are correct. So, that's what I generally prefer to do. So, yeah. Let's allow edits of our report. And it now generated a markdown report. We can always look at it and then the good thing is, let's say you have to set your um to a previous point in time, you may still have the report available if you put it into a shared folder, put it on your host for later. And you can just read this report with cloud and then tell it to continue from there. So, if you have multiple analysis sessions, this helps a lot. Let's check what we have in this report. Do we have glow installed? No. By the way, REMnux always has the password malware as sudo password. Um Okay, so now we have glow. And we can check out the report. Now we can see here everything that we need to do. Step-by-step verification. It even tells you how to extract the archive, which is kind of nice. Um Yeah, and now you get all of the steps and you can see, okay, only object and then I will verify that this is the actual URL that is used in in this attached template relationship and so on. So, this is This is a good start. So, now the if you analyze a different sample, you have a different analysis session, you may want to do the the same thing and you don't always want to write down how the or which things uh the AI should follow here. So, what you can do now is say, "Please put this into a skill." And you don't have to write the skill yourself. You just address it along the way. Because of the context, because of what we just did, it will create the skill based on the previous instructions we had here. I have a create report skill. And what's a skill? It just encapsulate instructions into a well, different file, basically. So, that the context of how to do things is only loaded when you need it. You don't want to send it every time you have a request. Whereas the cloud MD file, so how do you extract archives of infected password? This instruction will be sent every time. Now, we can see the skill here. And it will generate a well, instructions how to structure the report, which is interesting. Now, you can see, "Okay, is this what I want? Do I want to change something about this?" Um you can also just go with it, tell it to change things. So, no need to write your own skills. Trust. Do it based on how you work. There's one other thing I would like you to know. So, first off, now that your setup works, make a snapshot. That's important. You will at some point mess up your VM. At least if you're like me, and then you can just go back to the snapshot. Also, you will notice if you use this VM a lot for analysis, um the AI would clutter a lot of files of intermediate results and scripts and stuff that you don't want to clean up every time. So, you just go back to the latest snapshot where you have the updated skills, and then um you don't need to clean it up every time. So, one last thing, we haven't changed any of the settings here in regards to uh the the system. So, the system per default only has 4 GB of RAM. Let me take the snapshot, I think, in case I need it. So, to change RAM, you need to power off the machine. Okay, so now go to settings uh to system, and here you can increase RAM or number of processes used. Your system can handle everything that is in the green areas. Though later you may also want to connect for instance a Windows VM so that the AI can use this for dynamic analysis. And in that case of course you need to have enough RAM left to run both VMs simultaneously. Last but not least some words about reliability on the stuff that the large language model creates. So it's not reliable what it creates. So the reports are like roughly 80% of what's in there is correct and 20% is wrong. And that's very bad because it's a a high error rate. And the parts that are wrong are very important key points in a report. For instance it may say, "Oh, this sample copies itself to app data location and then puts an auto run entry there." When it's in reality putting itself to program data. So and slight things like these they might be wrong all over the report. And that is why you need some form of easy verification. And I prefer to let the large language model create scripts. Scripts that extract URLs that decrypts strings that extract the config. Because you can easily check those scripts if they are fake and just print the result or if they actually extract and convert data from the sample. And it's very easy, you run the script, get the output and you have your verification that this is actually happening. For everything else, I Well, just don't trust the report entirely, okay? Um also, you need to be aware that the large language model doesn't know when it has gathered enough facts or information to form a verdict. It will very often conclude, "Oh, the sample is clean or malicious." based on some indicators, like it will just get the re- the the imports and then tell you, "Oh, these imports are typical of a backdoor. This is a backdoor." And then when you ask it how it came to the conclusion, you will realize, "Well, that's actually not proof." So, and then you may even even the large language model itself may realize then, "Oh, yeah, that's actually not proof. Uh it's clean." And I had one analysis session where it uh changed its verdict during the session like three times. And this happens so often, you can't rely on the verdict that the large language model gives you. I mean, maybe you can introduce this with uh if you have special skills or strategy how it can when definition when it is allowed to form a certain verdict. However, this isn't the purpose. Uh the purpose is that the sample gives us ideas and tools very fast so that you can write your report faster. In the end, you are the one who needs to decide is this malicious or not. If you're a malware analyst, uh you don't need a tool to tell you what's malicious, right? You need a tool that just increases your speed a little. And that's what this is good for. Um yeah. >> Mhm.