def icedid_config()

in icedid/icedid.py [0:0]

• 24 lines of code
• 4 McCabe index (conditional complexity)

    def icedid_config(self, p: ProcessMemory, addr: int):
        log.info(
            "[+] IcedID loader config decryption YARA signature matched @ %X", addr
        )

        conf: Config = {}
        conf[self.family] = {}

        try:
            hit = p.uint32v(addr - 3)
            if not hit:
                return conf

            config_location = hit + addr + 1

            config_blob = p.readv(config_location, 250)
            key = config_blob[:32]
            conf["key"] = key.hex()

            data = config_blob[64:96]
            decrypted_config = xor(key, data)

            campaign_id = decrypted_config[:4]
            campaign_id = int.from_bytes(campaign_id, "little")

            raw = decrypted_config[4:]
            domains = [x.decode("UTF-8") for x in raw.split(b"\x00")]
            conf[self.family] = {"domains": domains, "campaign_id": campaign_id}

        except Exception as err:
            log.error(err)

        return conf