flare-vm

Behavioral Malware Analysis of a Simulated Multi-Stage Windows Malware Sample using FLARE-VM and REMnux. Evidence-driven DFIR investigation with IOC extraction, MITRE ATT&CK mapping, and detection engineering.

Reverse engineered a PE64 binary using IDA Pro. Identified XOR obfuscation (key: 0x5A) via static analysis, traced the decrypt() function, and recovered the hidden password. Includes Python decryption script & full walkthrough.

Analysis of a .NET malware loader tagged as Agent Tesla: hidden image payload, Defender-exclusion behavior, ATT&CK mapping, and draft YARA rules.

Comprehensive static malware analysis of suspicious Windows PE samples using REMnux, FLARE-VM, CAPA, PEStudio, FLOSS, PEview, and MITRE ATT&CK mapping.

A structured malware analysis lab covering static analysis, dynamic behavioral analysis, memory forensics, and detection engineering with Sigma and Wazuh.

Static and dynamic malware analysis of a trojanized Windows executable using FLARE VM, FLOSS, Metasploit, and Kali Linux.

Isolated FLARE VM malware analysis lab: safety process, PowerShell static triage and a report template mapping IOCs to MITRE ATT&CK.

Malware analysis and reverse engineering lab portfolio: static, dynamic and AI-assisted analysis with PeStudio, ANY.RUN, Ghidra, capa, OllyDbg and dnSpy.

Windows malware analysis lab: static and dynamic analysis of Practical Malware Analysis samples, with IOCs, MITRE ATT&CK mapping and tested YARA/Sigma rules.

End-to-end Black Basta ransomware analysis in an isolated FLARE-VM lab: static analysis, threat-intel enrichment and dynamic analysis, mapped to MITRE ATT&CK, with extracted IOCs and detection content (22 YARA rules, Sigma, KQL). Documentation only - no malware or weaponized code.

DFIR & Malware Analysis Case Study: Post-exploitation investigation of a compromised IIS Web Server, persistence implant detection, and AgentTesla RAT triage using Volatility 3, Wireshark, and Static PE Analysis.

Malware Analysis Lab: Static triage and dynamic behavioral profiling of RedLine Stealer using FLARE-VM, REMnux, Procmon, and FakeNet-NG.

Home cybersecurity lab built with VMware, Kali Linux, Wazuh SIEM, Metasploitable 2, Ubuntu Server, and FLARE VM for penetration testing, security monitoring, and malware analysis.

Isolated FLARE-VM + REMnux detonation lab for safe malware analysis and detection development.