FLARE VM: The Windows Malware Analysis Distribution You’ve Always Needed![html]
As a reverse engineer on the FLARE Team I rely on a customized
Virtual Machine (VM) to perform malware analysis. The Virtual Machine
is a Windows installation with numerous tweaks and tools to aid my
analysis. Unfortunately trying to maintain a custom VM like this is
very laborious: tools frequently get out of date and it is hard to
change or add new things. There is also a constant fear that if the VM
gets corrupted it would be super tedious to replicate all of the
settings and tools that I’ve built up over the years. To address this
and many related challenges, I have developed a standardized (but
easily customizable) Windows-based security distribution called FLARE VM.
FLARE VM is a freely available and open sourced Windows-based
security distribution designed for reverse engineers, malware
analysts, incident responders, forensicators, and penetration testers.
Inspired by open-source Linux-based security distributions like Kali
Linux, REMnux and others, FLARE VM delivers a fully configured
platform with a comprehensive collection of Windows security tools
such as debuggers, disassemblers, decompilers, static and dynamic
analysis utilities, network analysis and manipulation, web assessment,
exploitation, vulnerability assessment applications, and many others.
The distribution also includes the FLARE team’s public malware
analysis tools such as FLOSS and FakeNet-NG.
