AwesomeREA.org

Tool

FLARE-VM

Mandiant FLARE installer that sets up and maintains a Windows virtual machine for reverse engineering and malware analysis. Its PowerShell script uses Boxstarter and Chocolatey to install packages from the separate VM-Packages feed and the Chocolatey community feed, chosen in a GUI or a custom config.xml that also sets environment paths, the taskbar layout and post-install registry, service and path settings. The reviewed default configuration lists 137 packages, among them Ghidra, IDA Free, x64dbg, dnSpyEx, capa, FLOSS, PE-sieve, FakeNet-NG and Wireshark; scripts in its virtualbox folder build, snapshot and export FLARE-VM and REMnux VMs in VirtualBox.

Requirements and limitations

  • Needs a Windows 10 or later virtual machine with PowerShell 5+, at least 60 GB of disk and 2 GB of memory, a username without spaces or special characters and internet access. The README says FLARE-VM should only be installed on a VM and that Windows Updates, Tamper Protection and anti-malware must be disabled on it first; it recommends a snapshot before installation and host-only networking afterward. The installer checks that it is running in a VM and warns on Windows builds other than the tested 19045, 20348 and 26100.
  • FLARE-VM itself has no releases because its packages download tools from external URLs outside the project's control; the only release, vbox-1.0.0 (2025-08-13), holds Linux executables for some VirtualBox helper scripts, which were tested on Debian 12 with GNOME. Package updates are best effort and untested, failures of individual packages are reported to VM-Packages, and the README suggests a fresh install when updates break. The idapro.vm package needs the user's own IDA Pro installer, and optionally a license file, on the Desktop.
  • The scripts are Apache-2.0. Per the README's legal notice, every downloaded or installed package keeps its own license terms, which the user must review and accept; installing accepts those terms. Nothing was installed.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · mandiant/flare-vm · Revision 5dc321d
  2. README.md#L8-L18 GitHub · mandiant/flare-vm · Revision 5dc321d
  3. README.md#L172-L173 GitHub · mandiant/flare-vm · Revision 5dc321d
  4. install.ps1 GitHub · mandiant/flare-vm · Revision 5dc321d
  5. config.xml GitHub · mandiant/flare-vm · Revision 5dc321d
  6. virtualbox/README.md GitHub · mandiant/flare-vm · Revision 5dc321d
  7. LICENSE.txt GitHub · mandiant/flare-vm · Revision 5dc321d
  8. https://github.com/mandiant/flare-vm/releases/tag/vbox-1.0.0