Extract IcedID C2 domain name

IcedIDExtractC2.py

import binascii
import string
import pefile
import argparse

def extractPayload(file):
    # Extracting the payload from the .data section
    print("[+] Extracting the payload...")
    pe = pefile.PE(file)
    for section in pe.sections:
        if ".data" in str(section.Name):
            print("[+] Done !")
            return section.get_data()

def decodePayload(payload):
    decrypted = ""
    for i in range(32):
     decrypted += chr(payload[i+64] ^ payload[i])
    return decrypted.split("\x00")[0]

def main():
    parser = argparse.ArgumentParser(description='Decrypt the IcedID config')
    parser.add_argument('-f', '--file', help='Path of the binary file', required=True)
    args = parser.parse_args()
    payload = extractPayload(args.file)
    config = decodePayload(payload[4:]) #skipping the first 4 bytes
    print(f"The C2 config is : {config}")

if __name__ == "__main__":
    main()