mandiant/flare-vm
Flare Vm
Flare-VM este un mediu de analiză a malware-ului pentru Windows, constând în scripturi de instalare care automatizează provizionarea unei mașini virtuale. Oferă o suită cuprinzătoare de instrumente de reverse engineering, inclusiv decompile-ere și debuggere, alături de configurațiile de sistem necesare și variabilele de mediu pentru cercetarea în securitate.
Proiectul funcționează ca un orchestrator de imagini de mașini virtuale, permițând crearea, gestionarea și exportul automatizat al unor appliance-uri de analiză specializate. Dispune de selecție de instrumente bazată pe configurație și capacitatea de a extinde logica de instalare prin modificări personalizate de registru și definiții de layout de sistem.
Sistemul include capabilități pentru configurarea rețelei izolate pentru a preveni comunicarea externă prin modul host-only. De asemenea, gestionează întregul ciclu de viață al stărilor de analiză prin gestionarea stărilor bazată pe snapshot-uri, inclusiv capacitatea de a curăța sau exporta snapshot-uri ca fișiere appliance verificate.
Features
- Malware Analysis Environments - Provides specialized Windows configurations tailored specifically for reverse engineering and malware threat research.
- Reverse Engineering - Provides a curated environment tailored for disassembling and analyzing compiled binary code.
- Internal Virtual Network Isolations - Isolates lab networks using host-only virtual switches to prevent malware from communicating with the internet.
- Virtual Machine - Uses virtual machine snapshots to restore base states and export verified appliances for analysis.
- Environment Setup Tools - Installs a curated suite of reverse engineering software, tools, and configurations to prepare the analysis VM.
- Custom Container and VM Image Creation - Builds customized analysis environments by restoring snapshots, injecting files, and exporting the result as an appliance.
- Image Orchestrators - Automates the creation, snapshot management, and export of specialized analysis appliances.
- Automated Provisioning - Automates the installation and configuration of software and systems within a virtualized analysis environment.
- Provisioning Scripts - Automates the installation of software and system configurations through a series of executable provisioning scripts.
- Malware Analysis - Provides a secure environment and toolset for the reverse engineering and behavioral analysis of malicious software.
- Network Isolation - Implements network isolation to prevent analyzed malware from communicating with external networks via host-only mode.
- Reverse Engineering Toolsets - Installs a comprehensive curated collection of software configured for analyzing binaries and malicious code.
- Virtual Machine Snapshots - Includes capabilities to capture and restore virtual machine states to maintain clean analysis environments.
- VM Appliance Exports - Converts specific snapshots into appliance files with host-only network interfaces and verification hashes.
- Tool Selection Configuration - Provides a configuration system to select specific software packages and environment variables during the VM setup process.
- Post-Installation Extensions - Runs a sequence of custom scripts and service modifications after the primary software installation is complete.
- Windows Registry Modifications - Modifies Windows registry keys to alter system behavior and file extension visibility during environment setup.
- Connection Auditing - Checks internet adapter status across virtual machines to ensure they are restricted to host-only mode.
- Installation Logic Overrides - Allows adding custom installation steps such as registry modifications and service changes via configuration files.
- Security Lab Environments - Windows-based distribution for malware analysis and reverse engineering.
- Digital Forensics - Windows-based security distribution for malware analysis.
- System Hardening Guides - Automates the deployment of security analysis tools on workstations.
