MANDIANT

flare-vm

A collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on a VM.

commando-vm

Complete Mandiant Offensive VM (Commando VM), a fully customizable Windows-based pentesting virtual machine distribution. commandovm@mandiant.com

capa

The FLARE team's open-source tool to identify capabilities in executable files.

flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

flare-ida

IDA Pro utilities from FLARE team

flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool

speakeasy

Windows kernel and user mode emulation.

gocrack

GoCrack is a management frontend for password cracking tools written in Go

flare-emu

GoReSym

Go symbol recovery tool

stringsifter

A machine learning tool that ranks strings based on their relevance for malware analysis.

capa-rules

Standard collection of rules for capa: the tool for enumerating the capabilities of programs

ADFSpoof

PwnAuth

STrace

A DTrace on Windows Reimplementation

xrefer

FLARE Team's Binary Navigator

macos-UnifiedLogs

A cross platform parser for Apple UnifiedLogs!

Vulnerability-Disclosures

VM-Packages

Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.

GeoLogonalyzer

GeoLogonalyzer is a utility to analyze remote access logs for anomalies such as travel feasibility and data center sources.

dncil

The FLARE team's open-source library to disassemble Common Intermediate Language (CIL) instructions.

gostringungarbler

Python tool to resolve all strings in Go binaries obfuscated by garble

harbinger

gocrack-ui

The User Interface for GoCrack

gootloader

Collection of scripts used to deobfuscate GOOTLOADER malware samples.

poisonplug-scatterbrain

Deobfuscation library for PoisionPlug.SHADOW's ScatterBrain obfuscator

capa-testfiles

Data to test capa's code and rules.

flare-gsoc

Supporting resources and documentation for FLARE @ Google Summer of Code 2025

shelidate

flare-floss-testfiles

Resources for testing FLOSS by the FLARE team.