A script to statically decrypt license.dat files associated with IcedID infections.
The script will also decrypt the .data section from unpacked IcedID samples.
Notes:
- The script will automatically detect whether a PE file or license.dat file has been given.
- If a PE has been provided, the script assumes that the file has been unpacked first.
- If a decryption is successful, a raw dump will be written to output.bin
- As well, a quick string search will be performed, and detected strings written to a file.
- If an unpacked PE has been provided, C2's will be displayed on the screen.
Sample license.dat file
https://bazaar.abuse.ch/sample/1de8b101cf9f0fabc9f086bddb662c89d92c903c5db107910b3898537d4aa8e7
Sample Unpacked IcedID file
https://bazaar.abuse.ch/sample/669e69bc2a322d87cf3e21b3277f1a97ce550afb353074238b0be8faa317a82f/
Usage
icedid-decrypt.py --file unpacked_icedid.bin
icedid-decrypt.py --file license.dat
Sample
