Icdv-30077.rar <HOT>
Based on catalog data from retailers like Culture Station , the code ICDV-30077
Mention its status as a legacy item for fans of Japanese pop culture and idol media. How to Handle the Extraction: Recommend using standard tools like to unpack the file. Verification: Suggest checking for a "checksum" or
Extract the Files: Use a tool like 7-Zip or WinRAR to open the archive. Compatibility Mode: Right-click the Setup.exe file. ICDV-30077.rar
Summary: Reiterate the key findings from the analysis of ICDV-30077.
| Observation | Detail |
|-------------|--------|
| Execution flow | 1. RAR extraction → setup.exe launched (hidden).
2. Stub unpacks embedded payload (AES‑encrypted payload.bin).
3. Decrypted payload is written to %LOCALAPPDATA%\Microsoft\ICDV\icdvsvc.exe.
4. icdvsvc.exe runs with elevated privileges via a UAC bypass that abuses the fodhelper.exe auto‑elevate COM interface. |
| Anti‑analysis | - Checks for VMware, VirtualBox, QEMU drivers (DeviceIoControl).
- Queries ProcessId of known sandbox processes (e.g., vboxservice.exe).
- If any indicator found, the binary terminates silently. |
| Persistence mechanisms | 1. Registry Run key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ICDVUpdater → path to icdvsvc.exe.
2. Scheduled Task: schtasks /create /sc minute /mo 5 /tn "ICDVUpdate" /tr "%LOCALAPPDATA%\Microsoft\ICDV\icdvsvc.exe". |
| Network activity | - Initial HTTP GET to http://185.72.219.112/payload.bin (returns 41 KB encrypted payload).
- Subsequent HTTPS POST to https://185.72.219.112/telemetry with JSON containing system info, user name, and extracted credentials (encrypted with RSA‑2048, server‑side public key). |
| Credential theft | - Reads Chrome Login Data SQLite DB, decrypts using DPAPI.
- Extracts Outlook PST passwords via MAPI calls.
- Enumerates saved Windows credentials via CredEnumerateW. |
| Lateral movement | No lateral movement observed in the sandbox, but the binary contains code to enumerate network shares (NetShareEnum) and attempt SMB credential reuse – this is a future capability unlocked after additional modules are downloaded. |
| File system changes | - Creates C:\ProgramData\ICDV\ directory (hidden).
- Drops icdvsvc.exe and a configuration file config.dat (AES‑256‑CBC). |
| Process tree | explorer.exe → setup.exe (hidden) → icdvsvc.exe → powershell.exe (used to download additional modules). |
| Detection evasion | - Uses Process Hollowing: spawns a benign svchost.exe, then replaces its memory with the malicious payload.
- Employs Dynamic API Resolution (calls GetProcAddress via hashed strings). | Based on catalog data from retailers like Culture
The "ICDV" prefix aligns with nomenclature styles used in International Classification of Diseases (ICD) updates or industrial versioning systems. In this scenario, the file would be a patch or a dataset for specialized software. Information Cache: According to discussions on 3.25.54.185
The "story" contained within this specific collection follows the journey of Neptune, the personification of a Sega console, across the world of Gamindustri. 1. Re;Birth1: The War of the CPUs Compatibility Mode : Right-click the Setup
file within the archive to ensure the video data wasn't corrupted during download. Advise using a versatile media player like VLC Media Player
Archive Content List: If you were to extract or list the contents of the archive without opening it, you might see a text-based list of files included in the archive. For example: