mandiant/flare-vm
Flare Vm
Flare-VM est un environnement d'analyse de logiciels malveillants Windows composé de scripts d'installation qui automatisent le provisionnement d'une machine virtuelle. Il fournit une suite complète d'outils de rétro-ingénierie, incluant des décompilateurs et des débogueurs, ainsi que les configurations système et variables d'environnement nécessaires à la recherche en sécurité.
Le projet fonctionne comme un orchestrateur d'images de machine virtuelle, permettant la création, la gestion et l'exportation automatisées d'appliances d'analyse spécialisées. Il propose une sélection d'outils pilotée par la configuration et la possibilité d'étendre la logique d'installation via des modifications de registre personnalisées et des définitions de mise en page système.
Le système inclut des capacités de configuration réseau isolée pour empêcher toute communication externe via le mode hôte uniquement. Il gère également le cycle de vie complet des états d'analyse via une gestion d'état basée sur des snapshots, incluant la possibilité de nettoyer ou d'exporter des snapshots en tant que fichiers d'appliance vérifiés.
Features
- Malware Analysis Environments - Provides specialized Windows configurations tailored specifically for reverse engineering and malware threat research.
- Reverse Engineering - Provides a curated environment tailored for disassembling and analyzing compiled binary code.
- Internal Virtual Network Isolations - Isolates lab networks using host-only virtual switches to prevent malware from communicating with the internet.
- Virtual Machine - Uses virtual machine snapshots to restore base states and export verified appliances for analysis.
- Environment Setup Tools - Installs a curated suite of reverse engineering software, tools, and configurations to prepare the analysis VM.
- Custom Container and VM Image Creation - Builds customized analysis environments by restoring snapshots, injecting files, and exporting the result as an appliance.
- Image Orchestrators - Automates the creation, snapshot management, and export of specialized analysis appliances.
- Automated Provisioning - Automates the installation and configuration of software and systems within a virtualized analysis environment.
- Provisioning Scripts - Automates the installation of software and system configurations through a series of executable provisioning scripts.
- Malware Analysis - Provides a secure environment and toolset for the reverse engineering and behavioral analysis of malicious software.
- Network Isolation - Implements network isolation to prevent analyzed malware from communicating with external networks via host-only mode.
- Reverse Engineering Toolsets - Installs a comprehensive curated collection of software configured for analyzing binaries and malicious code.
- Virtual Machine Snapshots - Includes capabilities to capture and restore virtual machine states to maintain clean analysis environments.
- VM Appliance Exports - Converts specific snapshots into appliance files with host-only network interfaces and verification hashes.
- Tool Selection Configuration - Provides a configuration system to select specific software packages and environment variables during the VM setup process.
- Post-Installation Extensions - Runs a sequence of custom scripts and service modifications after the primary software installation is complete.
- Windows Registry Modifications - Modifies Windows registry keys to alter system behavior and file extension visibility during environment setup.
- Connection Auditing - Checks internet adapter status across virtual machines to ensure they are restricted to host-only mode.
- Installation Logic Overrides - Allows adding custom installation steps such as registry modifications and service changes via configuration files.
- Security Lab Environments - Windows-based distribution for malware analysis and reverse engineering.
- Digital Forensics - Windows-based security distribution for malware analysis.
- System Hardening Guides - Automates the deployment of security analysis tools on workstations.
