flare-vm v2.2.20 releases: Windows-based security distribution for malware analysis, incident response, penetration testing
FLARE VM – a fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing, etc..
Installed Tools
Debuggers
- OllyDbg + OllyDump + OllyDumpEx
- OllyDbg2 + OllyDumpEx
- x64dbg
- WinDbg
Disassemblers
- IDA Free
- IDA Free 7.0 (x64 bit only)
- Binary Ninja Demo
- Radare2 framework
- Cutter — GUI frontend for Radare2
Java
- JD-GUI
- dex2jar
Visual Basic
- VBDecompiler
Flash
- FFDec
.NET
- ILSpy
- DNSpy
- DotPeek
- De4dot
Office
- Offvis
- pdfid
- pdf-parser
- PdfStreamDumper
Hex Editors
- FileInsight
- HxD
- 010 Editor
PE
- PEiD
- ExplorerSuite (CFF Explorer)
- PEview
- DIE
- PeStudio
- LordPE
- Resource Hacker
Text Editors
- SublimeText3
- Vim
- Notepad++
Utilities
- MD5
- 7zip
- Putty
- Wireshark
- RawCap
- Wget
- UPX
- SysAnalyzer
- Process Hacker
- Sysinternals Suite
- Kernel-Mode driver loader
- API Monitor
- SpyStudio
- Checksum
- Unxutils
- YARA
- Cyber Chef
shellcode_launcher
- Py2ExeDecompiler
Python, Modules, Tools
- Python 2.7
- Hexdump
- PEFile
- Winappdbg
- FakeNet-NG
- Vivisect
- FLOSS
- FLARE_QDB
- PyCrypto
- Cryptography
Other
- VC Redistributable Modules (2008, 2010, 2012, 2013, 2015, 2017)
- Practical Malware Analysis Labs
- MAP — Malcode Analyst Pack
Changelog v2.2.20
Updates:
dotPeek.flare
updated to 2019.01pestudio.flare
udpated to 8.94ghidra.fireeye
updated to 9.0.2hashmyfiles.flare
updated to 2.35binaryninja.flare
updated to 1.1.1689
New tool:
SilkETW.fireeye
version 0.6acefile
module for python 3.7
Change:
metasploit.flare
is not installed by default. You can still install metasploit framework by running the following command with admin privilege:cinst -y metasploit.flare
.
Installation
Clone the repo
git clone https://github.com/fireeye/flare-vm.git
Create and configure a new Windows 7 or newer Virtual Machine. To install FLARE VM on an existing Windows VM, download and copy install.ps1 on your analysis machine. On the analysis machine open PowerShell as an Administrator and enable script execution by running the following command:
Set-ExecutionPolicy Unrestricted
Finally, execute the installer script as follows:
.\install.ps1
The script will set up the Boxstarter environment and proceed to download and install the FLARE VM environment. You will be prompted for the Administrator password in order to automate host restarts during installation.
Installing a new package
FLARE VM uses the chocolatey public and custom FLARE package repositories. It is easy to install a new package. For example, enter the following command as Administrator to deploy x64dbg on your system:
cinst x64dbg
Staying up to date
Type the following command to update all of the packages to the most recent version:
cup all
Source: https://github.com/fireeye/