Bring in Flare and Floss as the ICS community might find these useful.

Author: timyardley

tools/analysis/README.md

@@ -15,6 +15,7 @@
 * [YARA](https://plusvic.github.io/yara/) - YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strings and a boolean expression which determine its logic.
 * [Volatility](https://github.com/volatilityfoundation/volatility) - The Volatility Framework is a completely open collection of tools,implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.
 * [OPC Data Access IDAPython script](https://github.com/eset/malware-research/tree/master/industroyer) - An IDAPython script for IDA Pro that helps reverse engineer binaries that are using the OPC Data Access protocol. It can be used to analyse such malware families as Havex RAT and Win32/Industroyer.
+* [FLARE VM](https://github.com/fireeye/flare-vm) - FLARE VM is a fully customizable, Windows-based security distribution for malware analysis, incident response, penetration testing, etc.
 
 ### Network
 * [GRASSMARLIN] (https://github.com/iadgov/GRASSMARLIN) - GRASSMARLIN provides IP network situational awareness of industrial control systems (ICS) and Supervisory Control and Data Acquisition (SCADA) networks to support network security. Passively map, and visually display, an ICS/SCADA network topology while safely conducting device discovery, accounting, and reporting on these critical cyber-physical systems.
@@ -25,6 +26,7 @@
 ### Reverse Engineering
 * [Binwalk](https://github.com/ReFirmLabs/binwalk) - Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.
 * [ANGR](https://github.com/angr/angr) - A powerful and user-friendly binary analysis platform.
+* [Floss](https://github.com/fireeye/flare-floss) - FireEye Labs Obfuscated String Solver (FLOSS) uses advanced static analysis techniques to automatically deobfuscate strings from malware binaries.
 
 ### Samples
 * [Trisis/Triton/Hatman](https://github.com/ICSrepo/TRISIS-TRITON-HATMAN) - Repository containting original and decompiled files of TRISIS/TRITON/HATMAN malware