mandiant/flare-vm
Flare Vm
Flare-VM is a Windows malware analysis environment consisting of installation scripts that automate the provisioning of a virtual machine. It provides a comprehensive suite of reverse engineering tools, including decompilers and debuggers, along with the necessary system configurations and environment variables for security research.
The project functions as a virtual machine image orchestrator, allowing for the automated creation, management, and export of specialized analysis appliances. It features configuration-driven tool selection and the ability to extend installation logic through custom registry modifications and system layout definitions.
The system includes capabilities for isolated network configuration to prevent external communication via host-only mode. It also manages the full lifecycle of analysis states through snapshot-based state management, including the ability to clean up or export snapshots as verified appliance files.
Features
- Malware Analysis Environments - Provides specialized Windows configurations tailored specifically for reverse engineering and malware threat research.
- Reverse Engineering - Provides a curated environment tailored for disassembling and analyzing compiled binary code.
- Internal Virtual Network Isolations - Isolates lab networks using host-only virtual switches to prevent malware from communicating with the internet.
- Virtual Machine - Uses virtual machine snapshots to restore base states and export verified appliances for analysis.
- Environment Setup Tools - Installs a curated suite of reverse engineering software, tools, and configurations to prepare the analysis VM.
- Custom Container and VM Image Creation - Builds customized analysis environments by restoring snapshots, injecting files, and exporting the result as an appliance.
- Image Orchestrators - Automates the creation, snapshot management, and export of specialized analysis appliances.
- Automated Provisioning - Automates the installation and configuration of software and systems within a virtualized analysis environment.
- Provisioning Scripts - Automates the installation of software and system configurations through a series of executable provisioning scripts.
- Malware Analysis - Provides a secure environment and toolset for the reverse engineering and behavioral analysis of malicious software.
- Network Isolation - Implements network isolation to prevent analyzed malware from communicating with external networks via host-only mode.
- Reverse Engineering Toolsets - Installs a comprehensive curated collection of software configured for analyzing binaries and malicious code.
- Virtual Machine Snapshots - Includes capabilities to capture and restore virtual machine states to maintain clean analysis environments.
- VM Appliance Exports - Converts specific snapshots into appliance files with host-only network interfaces and verification hashes.
- Tool Selection Configuration - Provides a configuration system to select specific software packages and environment variables during the VM setup process.
- Post-Installation Extensions - Runs a sequence of custom scripts and service modifications after the primary software installation is complete.
- Windows Registry Modifications - Modifies Windows registry keys to alter system behavior and file extension visibility during environment setup.
- Connection Auditing - Checks internet adapter status across virtual machines to ensure they are restricted to host-only mode.
- Installation Logic Overrides - Allows adding custom installation steps such as registry modifications and service changes via configuration files.
- Security Lab Environments - Windows-based distribution for malware analysis and reverse engineering.
- Digital Forensics - Windows-based security distribution for malware analysis.
- System Hardening Guides - Automates the deployment of security analysis tools on workstations.
