mandiant/flare-vm
Flare Vm
Flare-VM es un entorno de análisis de malware para Windows que consiste en scripts de instalación que automatizan el aprovisionamiento de una máquina virtual. Proporciona un conjunto integral de herramientas de ingeniería inversa, incluyendo descompiladores y depuradores, junto con las configuraciones del sistema y variables de entorno necesarias para la investigación de seguridad.
El proyecto funciona como un orquestador de imágenes de máquinas virtuales, permitiendo la creación, gestión y exportación automatizadas de dispositivos de análisis especializados. Cuenta con selección de herramientas basada en configuración y la capacidad de extender la lógica de instalación mediante modificaciones personalizadas del registro y definiciones de diseño del sistema.
El sistema incluye capacidades para la configuración de red aislada para evitar la comunicación externa mediante el modo host-only. También gestiona el ciclo de vida completo de los estados de análisis mediante la gestión de estados basada en instantáneas, incluida la capacidad de limpiar o exportar instantáneas como archivos de dispositivo verificados.
Features
- Malware Analysis Environments - Provides specialized Windows configurations tailored specifically for reverse engineering and malware threat research.
- Reverse Engineering - Provides a curated environment tailored for disassembling and analyzing compiled binary code.
- Internal Virtual Network Isolations - Isolates lab networks using host-only virtual switches to prevent malware from communicating with the internet.
- Virtual Machine - Uses virtual machine snapshots to restore base states and export verified appliances for analysis.
- Environment Setup Tools - Installs a curated suite of reverse engineering software, tools, and configurations to prepare the analysis VM.
- Custom Container and VM Image Creation - Builds customized analysis environments by restoring snapshots, injecting files, and exporting the result as an appliance.
- Image Orchestrators - Automates the creation, snapshot management, and export of specialized analysis appliances.
- Automated Provisioning - Automates the installation and configuration of software and systems within a virtualized analysis environment.
- Provisioning Scripts - Automates the installation of software and system configurations through a series of executable provisioning scripts.
- Malware Analysis - Provides a secure environment and toolset for the reverse engineering and behavioral analysis of malicious software.
- Network Isolation - Implements network isolation to prevent analyzed malware from communicating with external networks via host-only mode.
- Reverse Engineering Toolsets - Installs a comprehensive curated collection of software configured for analyzing binaries and malicious code.
- Virtual Machine Snapshots - Includes capabilities to capture and restore virtual machine states to maintain clean analysis environments.
- VM Appliance Exports - Converts specific snapshots into appliance files with host-only network interfaces and verification hashes.
- Tool Selection Configuration - Provides a configuration system to select specific software packages and environment variables during the VM setup process.
- Post-Installation Extensions - Runs a sequence of custom scripts and service modifications after the primary software installation is complete.
- Windows Registry Modifications - Modifies Windows registry keys to alter system behavior and file extension visibility during environment setup.
- Connection Auditing - Checks internet adapter status across virtual machines to ensure they are restricted to host-only mode.
- Installation Logic Overrides - Allows adding custom installation steps such as registry modifications and service changes via configuration files.
- Security Lab Environments - Windows-based distribution for malware analysis and reverse engineering.
- Digital Forensics - Windows-based security distribution for malware analysis.
- System Hardening Guides - Automates the deployment of security analysis tools on workstations.
