AwesomeREA.org

Tool

FakeNet-NG

Mandiant FLARE's dynamic network analysis tool for malware analysts, a successor to the original Fakenet. Its Diverter redirects traffic from local processes on Windows, or from other hosts in Linux MultiHost mode, to configurable listeners that simulate DNS, HTTP and HTTPS, SMTP, FTP, TFTP, IRC, POP and raw TCP or UDP services, with process and host filters, custom responses and an option to launch a command such as a debugger on a connection. Sessions can be saved as PCAP and end with an interactive HTML report of network-based indicators grouped by process and protocol.

Requirements & limits

  • Latest release at review: v3.5, published 2025-04-09, as fakenet3.5.zip with a PyInstaller fakenet.exe for Windows. The reviewed master commit, 11 commits later and still versioned 3.5, adds a Windows release-build workflow, CRL generation for TLS revocation checks and SingleHost as the default NetworkMode, although the README still recommends Auto.
  • Module installs use Python 3.10.11 and administrator rights; Windows needs the Visual C++ build tools, and Linux needs build tools, Python and libnetfilter-queue development packages and port 53 freed from systemd-resolved, with the README's Linux steps tested on Ubuntu 24.04.2. SingleHost mode needs Windows Vista or later and is experimental on Linux, without process and host filtering; MultiHost is Linux-only, only TCP, UDP and ICMP are intercepted, and the Linux Diverter mishandles packets over 4,016 bytes.
  • The README recommends a controlled, isolated VM, because the tool changes the system's network settings, and says antivirus and EDR products may flag it. The repository bundles runtime helpers: WinDivert 32- and 64-bit DLLs and drivers, a small FakeNetMini.exe and other placeholder files served from defaultFiles, and TLS listener keys plus a static CA certificate and private key. The repository states no separate license for the WinDivert files, and the README notes that some dynamically loaded libraries may be LGPL; since the CA private key is public, trust that CA only inside the analysis VM.
  • docs/testing.md describes an interactive test/test.py suite and manual tests on Windows and Linux VMs on a host-only network; the GitHub workflow only builds the Windows PyInstaller release. FakeNet-NG itself is Apache-2.0. The reviewed sources state no REA use, and the tool was not run for this record.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary · Protocol

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · mandiant/flare-fakenet-ng · Revision 7c8e006
  2. fakenet/configs/default.ini GitHub · mandiant/flare-fakenet-ng · Revision 7c8e006
  3. CHANGELOG.txt GitHub · mandiant/flare-fakenet-ng · Revision 7c8e006
  4. docs/testing.md GitHub · mandiant/flare-fakenet-ng · Revision 7c8e006
  5. docs/CustomResponse.md GitHub · mandiant/flare-fakenet-ng · Revision 7c8e006
  6. .github/workflows/build.yaml GitHub · mandiant/flare-fakenet-ng · Revision 7c8e006
  7. windivert GitHub · mandiant/flare-fakenet-ng · Revision 7c8e006
  8. fakenet/defaultFiles GitHub · mandiant/flare-fakenet-ng · Revision 7c8e006
  9. setup.py GitHub · mandiant/flare-fakenet-ng · Revision 7c8e006
  10. LICENSE.txt GitHub · mandiant/flare-fakenet-ng · Revision 7c8e006
  11. https://github.com/mandiant/flare-fakenet-ng/releases/tag/v3.5

More in Native binaries

All 90 entries in Native binaries