REMnux

Free

remnux.org and the license page describe a free toolkit. No dollar price for the distro, the virtual appliance, or the containers was printed on the pages opened 21 Oct 2026. The license page says the tools are free and that each one keeps its own license, while the glue is GPL-3.0 unless stated otherwise. SANS FOR610 is named in the docs as a course that discusses many of the same tools. That course is a separate commercial offer. This listing does not quote a class fee that was not on the REMnux pages. Hardware you attach, and any cloud bill for an AMI, is not a REMnux license. The 4 GB and 100 GB figures are the page's sizing reference, not a price.

remnux.org, opened 21 Oct 2026, says REMnux is a Linux toolkit for reverse-engineering and analyzing malicious software, and that analysts can use the curated free tools hands-on or by directing AI agents. The same page names Lenny Zeltser as founder and primary maintainer from 2010, and it prints Content © 2010-2026 Zeltser Security Corp. The docs index says the distribution is based on Ubuntu. It does not print an Ubuntu version number, so this listing does not add one. The docs index also said it was last updated 5 days ago. That relative line is quoted as printed.

• Ubuntu, no point release. The docs index says the distro is based on Ubuntu and does not print a version number.
• GPL-3.0 for the glue. The license page says the glue is GPL-3.0 unless stated otherwise, and that bundled tools keep their own licenses.
• Appliance login. The virtual-appliance page documents user remnux and password malware for the downloadable VM. AMI copies lock that password.

1. 1

   Cite the OVA sha256 from the virtual-appliance page when you mean the VMware file, and leave a partial VirtualBox hash out.

2. 2

   Change the remnux account before the appliance is shared. The page prints that login so an operator can replace it.

3. 3

   Treat the distro as a local malware lab. Do not brief a boot as permission to touch a system you do not hold.

• A note is about to call every tool on the REMnux appliance GPL-3.0. On 21 Oct 2026 the license page said the glue that holds the toolkit together is GPL-3.0 unless stated otherwise, and that each bundled tool keeps its own license. Write the glue sentence and the per-tool sentence apart. The docs index says the distro is based on Ubuntu and does not print a point release.
• The downloadable appliance is about to be shared with the login the virtual-appliance page prints. That page says user remnux and password malware, and it says AMI copies lock the password and expect an SSH key. Change the downloadable account before the VM is reachable. The OVA copy control's sha256 is 060acb0087c7ae6d138d7a994f5a1daf957fe3f9d0fdf72012b2c43e88876ef9.
• A boot of the appliance is about to be briefed as permission to run a sample against a network. remnux.org describes a local malware-analysis toolkit. It does not grant access to a system you do not hold. OSINT and privacy Linux is only the nearest category in this directory. The job on the page is malware analysis.

Hard cases

The case where the first result is easy to over-read.

Questions

Titled sources. These public pages are what the quotes on this listing come from.