# FLARE-VM

> Mandiant FLARE installer that sets up and maintains a Windows virtual machine for reverse engineering and malware analysis. Its PowerShell script uses Boxstarter and Chocolatey to install packages from the separate VM-Packages feed and the Chocolatey community feed, chosen in a GUI or a custom config.xml that also sets environment paths, the taskbar layout and post-install registry, service and path settings. The reviewed default configuration lists 137 packages, among them Ghidra, IDA Free, x64dbg, dnSpyEx, capa, FLOSS, PE-sieve, FakeNet-NG and Wireshark; scripts in its virtualbox folder build, snapshot and export FLARE-VM and REMnux VMs in VirtualBox.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/mandiant/flare-vm>
- Primary source: <https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/README.md>
- Catalog page: <https://awesomerea.org/resources/flare-vm/>
- Record JSON: <https://awesomerea.org/resources/flare-vm/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/flare-vm/index.md)

## Requirements & limits

- Needs a Windows 10 or later virtual machine with PowerShell 5+, at least 60 GB of disk and 2 GB of memory, a username without spaces or special characters and internet access. The README says FLARE-VM should only be installed on a VM and that Windows Updates, Tamper Protection and anti-malware must be disabled on it first; it recommends a snapshot before installation and host-only networking afterward. The installer checks that it is running in a VM and warns on Windows builds other than the tested 19045, 20348 and 26100.
- FLARE-VM itself has no releases because its packages download tools from external URLs outside the project's control; the only release, vbox-1.0.0 (2025-08-13), holds Linux executables for some VirtualBox helper scripts, which were tested on Debian 12 with GNOME. Package updates are best effort and untested, failures of individual packages are reported to VM-Packages, and the README suggests a fresh install when updates break. The idapro.vm package needs the user's own IDA Pro installer, and optionally a license file, on the Desktop.
- The scripts are Apache-2.0. Per the README's legal notice, every downloaded or installed package keeps its own license terms, which the user must review and accept; installing accepts those terms.

## Primary sources

1. <https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/README.md>
2. <https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/README.md#L8-L18>
3. <https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/README.md#L172-L173>
4. <https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/install.ps1>
5. <https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/config.xml>
6. <https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/virtualbox/README.md>
7. <https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/LICENSE.txt>
8. <https://github.com/mandiant/flare-vm/releases/tag/vbox-1.0.0>

## More in Native binaries

- [B2R2](https://awesomerea.org/resources/b2r2/index.md) · Tool
- [rz-ghidra](https://awesomerea.org/resources/rz-ghidra/index.md) · Tool
- [dewolf](https://awesomerea.org/resources/dewolf/index.md) · Tool
- [decomp2dbg](https://awesomerea.org/resources/decomp2dbg/index.md) · Tool
- [E9Patch](https://awesomerea.org/resources/e9patch/index.md) · Tool
- [Rellic](https://awesomerea.org/resources/rellic/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.