Icedid-file-decryptor

KO | EN

gitlite — search

#javascript #android #machine-learning #rust #linux #docker #macos #java #awesome #cli #kubernetes #pytorch #openai #open-source

Icedid-file-decryptor

(★ 18)

Static Decryptor for IcedID Malware

Icedid-file-decryptor Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# IcedID Decryptor

A script to statically decrypt `license.dat` files associated with IcedID infections.

The script will also decrypt the `.data` section from unpacked IcedID samples.

Notes:
- The script will automatically detect whether a PE file or license.dat file has been given. 
- If a PE has been provided, the script assumes that the file has been unpacked first. 
- If a decryption is successful, a raw dump will be written to output.bin
- As well, a quick string search will be performed, and detected strings written to a file. 
- If an unpacked PE has been provided, C2's will be displayed on the screen.

**Sample `license.dat` file**

https://bazaar.abuse.ch/sample/1de8b101cf9f0fabc9f086bddb662c89d92c903c5db107910b3898537d4aa8e7

**Sample Unpacked IcedID file**

https://bazaar.abuse.ch/sample/669e69bc2a322d87cf3e21b3277f1a97ce550afb353074238b0be8faa317a82f/

**Usage**

`icedid-decrypt.py --file unpacked_icedid.bin`

`icedid-decrypt.py --file license.dat`

Sample

Icedid-file-decryptor

Icedid-file-decryptor Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Icedid-file-decryptor

Icedid-file-decryptor Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README