{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/README.md#L8-L18",
    "https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/README.md#L172-L173",
    "https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/install.ps1",
    "https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/config.xml",
    "https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/virtualbox/README.md",
    "https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/LICENSE.txt",
    "https://github.com/mandiant/flare-vm/releases/tag/vbox-1.0.0"
  ],
  "category": "native-analysis",
  "description_en": "Mandiant FLARE installer that sets up and maintains a Windows virtual machine for reverse engineering and malware analysis. Its PowerShell script uses Boxstarter and Chocolatey to install packages from the separate VM-Packages feed and the Chocolatey community feed, chosen in a GUI or a custom config.xml that also sets environment paths, the taskbar layout and post-install registry, service and path settings. The reviewed default configuration lists 137 packages, among them Ghidra, IDA Free, x64dbg, dnSpyEx, capa, FLOSS, PE-sieve, FakeNet-NG and Wireshark; scripts in its virtualbox folder build, snapshot and export FLARE-VM and REMnux VMs in VirtualBox.",
  "description_zh": "Mandiant FLARE 团队的安装脚本，用于搭建并维护一台面向逆向工程和恶意软件分析的 Windows 虚拟机。其 PowerShell 脚本借助 Boxstarter 和 Chocolatey，从独立的 VM-Packages 软件源和 Chocolatey 社区源安装软件包；软件包可在图形界面中选择，也可通过自定义 config.xml 指定，该文件还可设置环境变量路径、任务栏布局以及安装后的注册表、服务和路径设置。所审阅的默认配置列出 137 个软件包，包括 Ghidra、IDA Free、x64dbg、dnSpyEx、capa、FLOSS、PE-sieve、FakeNet-NG 和 Wireshark；virtualbox 目录中的脚本可在 VirtualBox 中构建 FLARE-VM 和 REMnux 虚拟机，并管理和导出其快照。",
  "entry_url": "https://awesomerea.org/resources/flare-vm/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/flare-vm/",
  "evidence_url": "https://github.com/mandiant/flare-vm/blob/5dc321d336f2d1b0c77343bdfd8cd3ac01ba1b37/README.md",
  "group": "tools",
  "id": "flare-vm",
  "json_url": "https://awesomerea.org/resources/flare-vm/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/flare-vm/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/flare-vm/index.md",
  "name": "FLARE-VM",
  "name_zh": "FLARE-VM 恶意软件分析虚拟机安装工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Needs a Windows 10 or later virtual machine with PowerShell 5+, at least 60 GB of disk and 2 GB of memory, a username without spaces or special characters and internet access. The README says FLARE-VM should only be installed on a VM and that Windows Updates, Tamper Protection and anti-malware must be disabled on it first; it recommends a snapshot before installation and host-only networking afterward. The installer checks that it is running in a VM and warns on Windows builds other than the tested 19045, 20348 and 26100.",
    "FLARE-VM itself has no releases because its packages download tools from external URLs outside the project's control; the only release, vbox-1.0.0 (2025-08-13), holds Linux executables for some VirtualBox helper scripts, which were tested on Debian 12 with GNOME. Package updates are best effort and untested, failures of individual packages are reported to VM-Packages, and the README suggests a fresh install when updates break. The idapro.vm package needs the user's own IDA Pro installer, and optionally a license file, on the Desktop.",
    "The scripts are Apache-2.0. Per the README's legal notice, every downloaded or installed package keeps its own license terms, which the user must review and accept; installing accepts those terms."
  ],
  "requirements_zh": [
    "需要一台 Windows 10 或更高版本的虚拟机，具备 PowerShell 5+、至少 60 GB 磁盘和 2 GB 内存、不含空格或特殊字符的用户名以及互联网连接。README 指出 FLARE-VM 只应安装在虚拟机上，并且安装前必须在该虚拟机上关闭 Windows 更新、篡改防护和反恶意软件；建议安装前先做快照，安装后切换为仅主机网络。安装程序会检查自身是否运行在虚拟机中，并在 Windows 版本不是经过测试的 19045、20348 和 26100 时发出警告。",
    "FLARE-VM 本身不发布版本，因为其软件包从项目无法控制的外部 URL 下载工具；唯一的发布 vbox-1.0.0（2025-08-13）只包含部分 VirtualBox 辅助脚本的 Linux 可执行文件，这些脚本在 Debian 12 和 GNOME 上测试过。软件包更新属于尽力而为且未经测试，单个软件包的安装失败应向 VM-Packages 报告；更新出问题时，README 建议重新全新安装。idapro.vm 软件包需要使用者自备的 IDA Pro 安装程序（以及可选的许可证文件）放在桌面上。",
    "脚本采用 Apache-2.0 许可。根据 README 的法律声明，每个下载或安装的软件包都保留各自的许可条款，使用者须自行查阅并接受，进行安装即表示接受这些条款。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mandiant/flare-vm",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}