FLARE-VM: A Comprehensive Guide to Establishing a Reverse Engineering Lab on Windows

Malware analysis and reverse engineering are essential skills for cybersecurity researchers, incident responders, and threat intelligence analysts. Understanding how malicious software operates requires a controlled environment equipped with debugging, disassembly, network monitoring, and forensic tools.

FLARE-VM (FireEye Labs Advanced Reverse Engineering Virtual Machine), maintained by Mandiant, provides a Windows-based malware analysis environment that simplifies tool installation and configuration. It uses Chocolatey and Boxstarter to automate the deployment of reverse engineering utilities, making it easier to establish a dedicated research laboratory.

What Is FLARE-VM?

FLARE-VM is an open-source collection of installation scripts that transforms a Windows virtual machine into a comprehensive reverse engineering workstation.

It supports static analysis, dynamic malware investigation, debugging, memory inspection, and network traffic analysis.

Unlike standalone tools, FLARE-VM combines multiple utilities into one environment, helping researchers examine suspicious executables, understand malware behavior, and identify indicators of compromise.

Step 1: Prepare the Windows Virtual Machine

Before installing FLARE-VM, create an isolated Windows virtual machine using VMware Workstation, VirtualBox, or another supported hypervisor.

Recommended system configuration:

Component	Configuration
Operating system	Windows 10 or Windows 11, 64-bit
RAM	4–8 GB recommended
Storage	80–100 GB
CPU	2–4 virtual processors
PowerShell	Version 5 or later
Network	NAT during installation; isolated afterward

Mandiant specifies minimum requirements of 2 GB RAM and 60 GB storage, although additional resources improve performance.

Install Windows, create a local administrator account with a username containing no spaces or special characters, and take an initial VM snapshot.

For installation, temporarily disable Windows Updates and, where required by the official installer, Windows Defender and Tamper Protection. Perform these changes only inside the disposable VM, never on the host system.

Step 2: Download and Install FLARE-VM

Start Windows PowerShell with administrator privileges inside the virtual machine.

Download the official installation script:

(New-Object Net.WebClient).DownloadFile(
'https://raw.githubusercontent.com/mandiant/flare-vm/main/install.ps1',
"$([Environment]::GetFolderPath('Desktop'))\install.ps1")

Navigate to the Desktop:

cd "$env:USERPROFILE\Desktop"

Unblock the downloaded script:

Unblock-File .\install.ps1

Enable PowerShell script execution as documented by Mandiant:

Set-ExecutionPolicy Unrestricted -Force

Review the downloaded script before running it, then execute:

.\install.ps1

The installer uses Chocolatey and Boxstarter to download dependencies, install security utilities, and configure the environment. Multiple automatic restarts may occur.

Once installation finishes, verify that the tools and shortcuts are available.

Step 3: Configure the Malware Analysis Laboratory

A malware laboratory must prevent suspicious programs from communicating with production systems or spreading beyond the virtual machine.

Configure the following protections:

1. Network isolation: Disconnect the VM from external networks before executing malware. Use an isolated virtual network for controlled simulations.
2. Disable integration features: Turn off shared folders, clipboard synchronization, and drag-and-drop.
3. Create snapshots: Save a clean, fully configured VM state before malware execution.
4. Simulate network services: Use FakeNet-NG to emulate network responses without providing genuine internet access.
5. Separate samples: Store suspicious files in designated analysis directories and avoid opening them on the host.

Host-only networking alone does not guarantee isolation from the host. Prefer an internal network without host connectivity for higher-risk samples.

Step 4: Configure Reverse Engineering Tools

FLARE-VM provides access to numerous tools for examining executable structure and runtime behavior.

Tool	Primary purpose
Ghidra	Disassembly and decompilation
x64dbg	Windows executable debugging
IDA Free	Static binary analysis
PE-bear	Portable Executable inspection
Detect It Easy	Compiler and packer identification
FLOSS	Extraction of obfuscated strings
Process Monitor	File, registry, and process monitoring
Wireshark	Network packet inspection
FakeNet-NG	Simulated network communications

Tool availability varies by installation configuration.

Begin static analysis by checking file hashes, executable headers, imports, strings, and suspicious functions. Subsequently, use a debugger to examine execution flow and memory behavior.

Step 5: Perform a Controlled Malware Analysis

A structured investigation generally follows three phases.

Static analysis: Examine the suspicious file without executing it. Identify embedded strings, imported APIs, executable sections, and possible obfuscation.

Dynamic analysis: Inside the isolated VM, observe process creation, registry modifications, file-system activity, and attempted network connections.

Reverse engineering: Load the executable into Ghidra or x64dbg to investigate suspicious functions, control flow, configuration data, and malware capabilities.

Document indicators of compromise, including file hashes, registry artifacts, and network destinations.

After completing the investigation, revert the VM to its clean snapshot rather than relying on manual malware removal.

Conclusion

FLARE-VM provides cybersecurity professionals with a customizable Windows environment for malware analysis and reverse engineering.

By combining virtualization, automated tool installation, network isolation, and repeatable analysis procedures, researchers can investigate suspicious software while reducing the risk of compromising production systems.

Official project: Mandiant FLARE-VM GitHub Repository.