FLARE FLOSS — authorized string extraction

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

FLARE FLOSS (mandiant/flare-floss) is a static string extraction utility aimed at obfuscated malware and packed lab samples. Release v3.2.0 (2026-10-16 UTC) is the latest non-prerelease checked on 2026-10-24. License is Apache-2.0. Use it on binaries you are authorized to examine.

On this page

Snapshot

FieldValue
LicenseApache-2.0
Latest checkedv3.2.0 (2026-10-16 UTC)
JobExtract plain + obfuscated strings from executables
Stars (order of magnitude)~4.2k on GitHub (counts change daily)
Typical next stepFeed interesting strings into YARA / capa / a disassembler

Allowed framing

  • Incident-response samples under ticketed authorization.
  • Lab malware corpora you may legally hold.
  • Your own packed test builds for training.

Scope we will not cover

  • No guides to build crypters, packers or stealers.
  • No “bypass AV with FLOSS tips” framing.
  • No sample hosting on BinBench.

Beginner path (authorized only)

  1. Work in an isolated VM; snapshot before opening unknown samples.
  2. Install from official mandiant/flare-floss Releases.
  3. Run FLOSS against a hash-recorded sample; save stdout to your case notes.
  4. Cross-check findings with capa and YARA.
  5. Open the binary in a disassembler only after triage confirms you still have authorization.
Which to pick
  • Use FLOSS early in authorized malware triage for string recovery.
  • Pair with capa/YARA; do not treat strings alone as proof of intent.
  • Prefer official Mandiant/FLARE builds.

For legal, authorized and educational use only.

FAQ

What is FLOSS?

FLOSS (FireEye Labs Obfuscated String Solver, now under Mandiant’s FLARE tooling) extracts printable and obfuscated strings from executable files using static techniques — without running the sample by default.

Which version is cited?

v3.2.0 published 2026-10-16 UTC on mandiant/flare-floss Releases (checked 2026-10-24).

Is FLOSS open source?

Yes. GitHub reports Apache-2.0 for mandiant/flare-floss (checked 2026-10-24).

Can I run FLOSS on random malware from the internet?

Only samples you are authorized to hold, inside an isolated lab with write-blocked evidence disks.

Does this teach writing crypters?

No. Analysis of authorized samples only — topic plan §4 excludes malware writing.

Sources