Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit adbbab7

Browse files
author
Nhan Huynh
committed
merge master into flare-vm-2.0
2 parents 66d5339 + 6744fb7 commit adbbab7

File tree

1 file changed

+291
-0
lines changed

1 file changed

+291
-0
lines changed

‎flarevm_malware.ps1‎

Lines changed: 291 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,291 @@
1+
# FLARE VM - Malware Analysis Edition
2+
3+
Write-Host " ______ _ _____ ______ __ ____ __ "
4+
Write-Host " | ____| | /\ | __ \| ____| \ \ / / \/ |"
5+
Write-Host " | |__ | | / \ | |__) | |__ _____\ \ / /| \ / |"
6+
Write-Host " | __| | | / /\ \ | _ /| __|______\ \/ / | |\/| |"
7+
Write-Host " | | | |____ / ____ \| | \ \| |____ \ / | | | |"
8+
Write-Host " |_| |______/_/ \_\_| \_\______| \/ |_| |_|"
9+
Write-Host " M A L W A R E A N A L Y S I S E D I T I O N "
10+
Write-Host " "
11+
Write-Host " Version 1.0 "
12+
Write-Host " ________________________________________________________"
13+
Write-Host " Developed by "
14+
Write-Host " Peter Kacherginsky "
15+
Write-Host " FLARE (FireEye Labs Advanced Reverse Engineering) "
16+
Write-Host " _______________________________________________________ "
17+
Write-Host " "
18+
Write-Host "This download configuration script is provided to assist cyber security analysts"
19+
Write-Host "in creating handy and versatile toolboxes for malware analysis environments. It"
20+
Write-Host "provides a convenient interface for them to obtain a useful set of analysis"
21+
Write-Host "tools directly from their original sources. Installation and use of this script"
22+
Write-Host "is subject to the Apache 2.0 License."
23+
Write-Host " "
24+
Write-Host "You as a user of this script must review, accept and comply with the license"
25+
Write-Host "terms of each downloaded/installed package listed below. By proceeding with the"
26+
Write-Host "installation, you are accepting the license terms of each package, and"
27+
Write-Host "acknowledging that your use of each package will be subject to its respective"
28+
Write-Host "license terms."
29+
Write-Host ""
30+
Write-Host "List of package licenses:"
31+
Write-Host ""
32+
Write-Host "http://www.ollydbg.de/download.htm, http://www.ollydbg.de/download.htm,"
33+
Write-Host "https://github.com/x64dbg/x64dbg/blob/development/LICENSE,"
34+
Write-Host "http://go.microsoft.com/fwlink/?LinkID=251960,"
35+
Write-Host "https://www.hex-rays.com/products/ida/support/download_freeware.shtml,"
36+
Write-Host "https://docs.binary.ninja/about/license/#demo-license,"
37+
Write-Host "https://github.com/icsharpcode/ILSpy/blob/master/doc/license.txt,"
38+
Write-Host "https://github.com/0xd4d/dnSpy/blob/master/dnSpy/dnSpy/LicenseInfo/GPLv3.txt,"
39+
Write-Host "https://www.jetbrains.com/decompiler/download/license.html,"
40+
Write-Host "https://github.com/0xd4d/de4dot/blob/master/LICENSE.de4dot.txt,"
41+
Write-Host "http://www.oracle.com/technetwork/java/javase/terms/license/index.html,"
42+
Write-Host "https://github.com/java-decompiler/jd-gui/blob/master/LICENSE,"
43+
Write-Host "https://www.vb-decompiler.org/license.htm, http://kpnc.org/idr32/en/,"
44+
Write-Host "https://www.free-decompiler.com/flash/license/,"
45+
Write-Host "https://www.mcafee.com/hk/downloads/free-tools/fileinsight.aspx,"
46+
Write-Host "https://mh-nexus.de/en/hxd/license.php,"
47+
Write-Host "https://www.sweetscape.com/010editor/manual/License.htm,"
48+
Write-Host "http://www.ntcore.com/exsuite.php, http://wjradburn.com/software/,"
49+
Write-Host "http://ntinfo.biz, https://www.sublimetext.com,"
50+
Write-Host "https://github.com/notepad-plus-plus/notepad-plus-plus/blob/master/LICENSE,"
51+
Write-Host "http://vimdoc.sourceforge.net/htmldoc/uganda.html,"
52+
Write-Host "http://www.gnu.org/licenses/gpl-2.0.html,"
53+
Write-Host "https://raw.githubusercontent.com/ferventcoder/checksum/master/LICENSE,"
54+
Write-Host "http://www.7-zip.org/license.txt,"
55+
Write-Host "http://www.chiark.greenend.org.uk/~sgtatham/putty/licence.html,"
56+
Write-Host "http://www.gnu.org/copyleft/gpl.html,"
57+
Write-Host "https://cdn.rawgit.com/iggi131/packages/master/RawCap/license.txt,"
58+
Write-Host "https://www.gnu.org/copyleft/gpl.html,"
59+
Write-Host "http://upx.sourceforge.net/upx-license.html,"
60+
Write-Host "http://technet.microsoft.com/en-us/sysinternals/bb469936,"
61+
Write-Host "http://www.rohitab.com/apimonitor,"
62+
Write-Host "http://whiteboard.nektra.com/spystudio/spystudio_license,"
63+
Write-Host "http://www.slavasoft.com/hashcalc/license-agreement.htm,"
64+
Write-Host "http://www.gnu.org/licenses/gpl-2.0.html,"
65+
Write-Host "http://www.techworld.com/download/portable-applications/microsoft-offvis-11-3214034/,"
66+
Write-Host "http://exeinfo.atwebpages.com,"
67+
Write-Host "https://www.python.org/download/releases/2.7/license/,"
68+
Write-Host "https://www.microsoft.com/en-us/download/details.aspx?id=44266,"
69+
Write-Host "https://raw.githubusercontent.com/IntelliTect/Licenses/master/WindowsManagementFramework.txt,"
70+
Write-Host "http://msdn.microsoft.com/en-US/cc300389.aspx,"
71+
Write-Host "https://raw.githubusercontent.com/chocolatey/choco/master/LICENSE"
72+
Write-Host "https://blog.didierstevens.com/programs/xorsearch/"
73+
Write-Host "http://sandsprite.com/iDef/MAP/"
74+
Write-Host "http://sandsprite.com/iDef/SysAnalyzer/"
75+
Write-Host "http://virustotal.github.io/yara/"
76+
Write-Host "http://www.novirusthanks.org/products/kernel-mode-driver-loader/"
77+
Write-Host "http://www.woodmann.com/collaborative/tools/index.php/LordPE"
78+
Write-Host "https://github.com/gchq/CyberChef"
79+
Write-Host "http://sandsprite.com/CodeStuff/scdbg_manual/MANUAL_EN.html"
80+
Write-Host "http://retdec.com"
81+
Write-Host "http://www.cygwin.com/"
82+
Write-Host "https://portswigger.net/burp"
83+
Write-Host "https://bytecodeviewer.com/"
84+
85+
###############################################################################
86+
# Configure system
87+
###############################################################################
88+
89+
# Boxstarter options
90+
$Boxstarter.RebootOk=$true # Allow reboots?
91+
$Boxstarter.NoPassword=$false # Is this a machine with no login password?
92+
$Boxstarter.AutoLogin=$true # Save my password securely and auto-login after a reboot
93+
94+
# Basic setup
95+
Update-ExecutionPolicy Unrestricted
96+
Disable-MicrosoftUpdate
97+
Set-WindowsExplorerOptions -EnableShowProtectedOSFiles -EnableShowFileExtensions -EnableShowHiddenFilesFoldersDrives
98+
Set-TaskbarOptions -Size Small
99+
Disable-BingSearch
100+
101+
###############################################################################
102+
# Install Chocolatey packages
103+
###############################################################################
104+
105+
# Configure FLARE chocolatey feed
106+
$flare = "https://www.myget.org/F/flare/api/v2"
107+
108+
$cache = "$env:userprofile\AppData\Local\ChocoCache"
109+
New-Item -Path $cache -ItemType directory -Force
110+
111+
# Make a FLARE desktop folder
112+
$startPath = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FLARE"
113+
114+
if( -not (Test-Path -path $startPath) ) { New-Item -Path $startPath -ItemType directory }
115+
116+
$desktopShortcut = Join-Path ${Env:USERPROFILE} "Desktop\FLARE.lnk"
117+
118+
Install-ChocolateyShortcut -shortcutFilePath $desktopShortcut -targetPath $startPath
119+
120+
###############################################################################
121+
# Install packages
122+
123+
# Set up Chocolatey
124+
cmd.exe /c choco sources add -n=flare -s "https://www.myget.org/F/flare/api/v2" --priority 1
125+
cmd.exe /c choco feature enable -n allowGlobalConfirmation
126+
cmd.exe /c choco feature enable -n allowEmptyChecksums
127+
128+
cinst cmdermini.flare -s $flare --cacheLocation $cache #
129+
130+
# Packages requiring reboot
131+
cinst powershell --cacheLocation $cache
132+
cinst dotnet4.7.2 --cacheLocation $cache
133+
134+
# Visual C++ Redistributable Packages
135+
cinst vcredist2005 --cacheLocation $cache
136+
cinst vcredist2008 --cacheLocation $cache
137+
cinst vcredist2010 --cacheLocation $cache
138+
cinst vcredist2012 --cacheLocation $cache
139+
cinst vcredist2013 --cacheLocation $cache
140+
cinst vcredist2015 --cacheLocation $cache
141+
142+
143+
# Debuggers
144+
cinst ollydbg -s $flare --cacheLocation $cache # OllyDbg 1.10
145+
cinst ollydbg.ollydump -s $flare --cacheLocation $cache # OllyDump plugin
146+
cinst ollydbg.ollydumpex -s $flare --cacheLocation $cache # OllyDumpEx plugin
147+
148+
cinst ollydbg2 -s $flare --cacheLocation $cache # OllyDbg 2.0
149+
cinst ollydbg2.ollydumpex -s $flare --cacheLocation $cache # OllyDumpEx plugin
150+
151+
cinst x64dbg -s $flare --cacheLocation $cache # x64dbg
152+
cinst x64dbg.py -s $flare --cacheLocation $cache # Python Scripting Engine for x64dbg
153+
cinst windbg -s $flare --cacheLocation $cache # WinDbg x86, x64, .NET
154+
cinst windbg.kenstheme -s $flare --cacheLocation $cache # Ken's WinDbg theme
155+
cinst windbg.ollydumpex -s $flare --cacheLocation $cache # OllyDumpEx plugin
156+
cinst windbg.pykd -s $flare --cacheLocation $cache
157+
cinst scdbg -s $flare --cacheLocation $cache
158+
cinst retdec -s $flare --cacheLocation $cache
159+
# Disassemblers
160+
if(Get-OSArchitectureWidth -Compare 64) {
161+
# IDA 7.0 is only 64bit
162+
cinst idafree70 -s $flare --cacheLocation $cache # IDA Free 7.0
163+
}
164+
cinst idafree -s $flare --cacheLocation $cache # IDA Free
165+
cinst binaryninja -s $flare --cacheLocation $cache # Binary Ninja Demo
166+
cinst radare2.flare -s $flare --cacheLocation $cache # Radare2 framework
167+
cinst cutter.flare -s $flare --cacheLocation $cache # Cutter is a GUI for radare2
168+
169+
# .NET
170+
cinst ilspy.flare -s $flare --cacheLocation $cache # ILSpy
171+
cinst dnspy.flare -s $flare --cacheLocation $cache # dnSpy
172+
cinst dotpeek.flare -s $flare --cacheLocation $cache # dotPeek
173+
cinst de4dot -s $flare --cacheLocation $cache # de4dot
174+
175+
# Java
176+
cinst javaruntime --cacheLocation $cache # JRE
177+
cinst jd-gui -s $flare --cacheLocation $cache # JD-GUI
178+
cinst bytecode-viewer.flare -s $flare --cacheLocation $cache # ByteCodeViewer
179+
cinst dex2jar --cacheLocation $cache # dex2jar
180+
181+
# VB
182+
cinst vbdecompiler -s $flare --cacheLocation $cache # VB Decompiler Lite
183+
184+
# Delphi
185+
cinst idr.small -s $flare --cacheLocation $cache # IDR (small edition)
186+
187+
# Flash
188+
cinst ffdec -s $flare --cacheLocation $cache # FFDec
189+
190+
# Hex Editors
191+
cinst fileinsight -s $flare --cacheLocation $cache # FileInsight
192+
cinst hxd.flare -s $flare --cacheLocation $cache # HxD
193+
cinst 010editor -s $flare --cacheLocation $cache # 010 Editor
194+
195+
# Web
196+
cinst burp.free.flare -s $flare --cacheLocation $cache
197+
198+
# PE
199+
cinst peid -s $flare --cacheLocation $cache # PEiD
200+
cinst explorersuite -s $flare --cacheLocation $cache # CFF Explorer
201+
cinst peview -s $flare --cacheLocation $cache # PEview
202+
cinst die -s $flare --cacheLocation $cache # DIE
203+
cinst pestudio -s $flare --cacheLocation $cache # PEStudio
204+
cinst resourcehacker.flare -s $flare --cacheLocation $cache # Resource Hacker
205+
206+
# Text Editors
207+
cinst sublimetext3 -s $flare --cacheLocation $cache # Sublime Text 3
208+
cinst notepadplusplus --cacheLocation $cache
209+
210+
# Utilities
211+
cinst unxutils --cacheLocation $cache # Unix Utils
212+
cinst checksum --cacheLocation $cache # Hash Calculator
213+
cinst 7zip.install --cacheLocation $cache # 7-Zip
214+
cinst putty --cacheLocation $cache # Putty
215+
cinst wireshark.flare -s $flare --cacheLocation $cache # WireShark
216+
cinst winpcap --cacheLocation $cache
217+
cinst rawcap --cacheLocation $cache # RawCap
218+
cinst wget --cacheLocation $cache # Wget
219+
cinst upx --cacheLocation $cache # UPX
220+
cinst processhacker.flare -s $flare --cacheLocation $cache # Process Hacker
221+
cinst sysinternals.flare -s $flare --cacheLocation $cache # Sysinternals wrapper
222+
cinst apimonitor -s $flare --cacheLocation $cache # API Monitor
223+
cinst spystudio.flare -s $flare --cacheLocation $cache # SpyStudio
224+
cinst hashcalc -s $flare --cacheLocation $cache # HashCalc
225+
cinst regshot -s $flare --cacheLocation $cache # RegShot
226+
cinst exeinfope -s $flare --cacheLocation $cache # ExeInfo PE
227+
cinst hashmyfiles --cacheLocation $cache # HashMyFiles
228+
cinst ncat -s $flare --cacheLocation $cache # Ncat
229+
cinst shellcode_launcher -s $flare --cacheLocation $cache # shellcode_launcher
230+
cinst xorsearch -s $flare --cacheLocation $cache
231+
cinst xorstrings -s $flare --cacheLocation $cache
232+
cinst yara.flare -s $flare --cacheLocation $cache
233+
cinst kmdloader.flare -s $flare --cacheLocation $cache
234+
cinst lordpe.flare -s $flare --cacheLocation $cache
235+
cinst cyberchef.flare -s $flare --cacheLocation $cache
236+
cinst py2exedecompiler -s $flare --cacheLocation $cache
237+
cinst cygwin.flare -s $flare --cacheLocation $cache
238+
239+
# Malcode Analyst Pack
240+
cinst MAP -s $flare --cacheLocation $cache
241+
cinst SysAnalyzer -s $flare --cacheLocation $cache
242+
243+
# Practical Malware Analysis Labs
244+
cinst pmalabs -s $flare --cacheLocation $cache
245+
246+
# Office
247+
cinst offvis -s $flare --cacheLocation $cache # OffVis
248+
cinst officemalscanner -s $flare --cacheLocation $cache # OfficeMalScanner
249+
250+
# PDF
251+
cinst pdfid -s $flare --cacheLocation $cache
252+
cinst pdfparser -s $flare --cacheLocation $cache
253+
cinst pdfstreamdumper -s $flare --cacheLocation $cache
254+
255+
# Android
256+
cinst apktool -s $flare --cacheLocation $cache # ApkTool
257+
258+
# Python
259+
cinst python3
260+
cinst python2 --package-parameters '/InstallDir:"C:\Program Files\Python27"' --cacheLocation $cache # Python 2.7 - Using private version
261+
cinst python -s $flare --version 2.7.14 --cacheLocation $cache
262+
choco pin add -n=python --version 2.7.14
263+
264+
cinst vcpython27 --cacheLocation $cache # Microsoft Visual C++ Compiler for Python 2.7
265+
266+
# PyKD requires installation of 32-bit Python in 64-bit systems in order to function properly
267+
if(Get-OSArchitectureWidth -Compare 64) {
268+
cinst python2.nopath -s $flare --x86 --package-parameters '/InstallDir:"C:\Program Files (x86)\Python27"' --cacheLocation $cache
269+
}
270+
271+
# Python Modules
272+
cinst hexdump -source python --cacheLocation $cache
273+
cinst pefile -source python --cacheLocation $cache
274+
cinst winappdbg -source python --cacheLocation $cache
275+
cinst pycrypto -source python --cacheLocation $cache # Cryptographic modules for Python
276+
cinst cryptography -source python --cacheLocation $cache # Cryptography for humans
277+
cinst https://github.com/williballenthin/vivisect/zipball/master -source python --cacheLocation $cache # Vivisect
278+
cinst capstone-windows -source python --cacheLocation $cache
279+
cinst unicorn -source python --cacheLocation $cache
280+
281+
# Python Tools
282+
cinst oletools -source python --cacheLocation $cache # Python tools to analyze OLE and MS Office files
283+
cinst fakenet-ng.python -s $flare --cacheLocation $cache # FakeNet-NG
284+
cinst floss.python -s $flare --cacheLocation $cache # FLOSS
285+
cinst https://github.com/fireeye/flare-qdb/zipball/master -source python --cacheLocation $cache # FLARE-QDB
286+
287+
# clean up the cache directory
288+
Remove-Item $cache -Recurse
289+
290+
# Install flarevm last to avoid cleaning up temporary resource used by flarevm
291+
cinst flarevm -s $flare --cacheLocation $cache # FLARE VM specific configurations

0 commit comments

Comments
 (0)