FLARE-VM — authorized Windows malware-analysis lab orientation

Last updated: · By the BinBench editorial team · Stars and releases checked via the GitHub API
For legal, authorized and educational use only. Only analyze software you own or have written permission to examine.
Quick answer

FLARE-VM (mandiant/flare-vm) automates a Windows reverse-engineering lab via Chocolatey/Boxstarter. License on the scripts is Apache-2.0. Install only on an isolated VM you administer, for samples you are authorized to hold.

On this page

Snapshot

FieldValue
LicenseApache-2.0 (installer scripts)
PackagingChocolatey packages from mandiant/VM-Packages
JobCurate RE/malware-analysis tools on Windows VMs
Peerscapa, FLOSS, YARA

Allowed framing

  • Building a disposable Windows analysis VM for coursework or SOC malware triage you are authorized to perform.
  • Teaching tool inventory (disassemblers, FLOSS, capa, etc.) under lab network isolation.
  • Reproducing a known good lab baseline before loading case samples.

Scope we will not cover

  • No install-on-bare-metal daily driver guidance that contradicts upstream VM-only warnings.
  • No exploit PoC / malware packaging cookbooks.
  • No “disable every control forever on a production domain join” abuse framing — follow upstream lab hardening notes for analysis VMs only.

Beginner path (authorized only)

  1. Create a fresh Windows ≥10 VM with adequate disk (≥60 GB per upstream) and snapshot capability.
  2. Read the current flare-vm README requirements (PowerShell version, username constraints, Defender/Tamper Protection, updates).
  3. Run the documented install.ps1 path as Administrator only inside that VM; accept each package license.
  4. After install, prefer host-only / isolated networking before opening malware samples; take a clean snapshot.
  5. Analyze only authorized corpora; escalate capability questions to tools such as capa rather than inventing bypasses.
Which to pick
  • Use FLARE-VM to bootstrap authorized Windows RE labs.
  • Prefer isolated VMs + snapshots; never treat it as a daily OS.
  • Refuse weaponization and unauthorized-sample framing.

For legal, authorized and educational use only.

FAQ

What is FLARE-VM?

FLARE-VM is Mandiant's open collection of Windows installation scripts (Chocolatey + Boxstarter) that configure a reverse-engineering / malware-analysis toolbox on a virtual machine — not a pre-built appliance image you download as one OVA.

Which version is cited?

The installer tracks the live package feed (mandiant/VM-Packages → MyGet). GitHub may publish helper tags such as VirtualBox script releases; there is no single frozen “FLARE-VM 2026 ISO.” Pin package versions your lab accepts (checked 2026-10-24).

What license applies?

Apache-2.0 on the flare-vm scripts. You must separately accept each installed tool's license — the README legal notice is explicit.

Can I install FLARE-VM on a daily-driver laptop?

Upstream states it should ONLY be installed on a virtual machine. Follow their requirements (Windows ≥10, disk/RAM floors, Defender/Tamper Protection handling per their docs) inside an isolated lab network.

Does this teach malware weaponization or unauthorized sampling?

No. Authorized DFIR/malware-analysis labs and education only — BinBench will not supply exploit PoCs, pirate corpora or live-system infection recipes.

Sources