Cybercrime Challange #11

Stuck with the cybercrime challenge 2013 (0x7dd) - You found out that Vultura is there but now it's harder?

Here is the solution for question number 11.

Did you get the answer of the BOT in the channel?
You noticed this is a base64 encoded string but if you decode it you get all garbage.

This is were crypto comes in place, but for crypto to work you need a password.
The password is encrypted in the memory.raw, to retrieve it you need some difficult tools like volatilitux. In order for volatilitux to work you need to create a profile which can be hard.

The answer of question 11 is not found on the internet because it changes constantly.

Therefor I made the following perl script that can decrypt it successfully for you

You need to go the directory where you have placed the file 'crypto' and 'memory.raw'
And run the following command:

SEARCHIN=memory.raw
CRYPTOFILE=crypto
perl -e "$(echo -n 'QlpoOTFBWSZTWe9xM1QAATWfgFx14d8q+/8EP+/fqzABazNkGqehACabUGTENDQGQ0DTajQDSZRiYhQ8p+oBNAwQwACek9QSSTJok/VPTCmammj0gyAAGIBpAmmtYGJ42Jw9wkE5hQTM5mlBY3N6aXakfm4Yn+51eYHEWyyBYw9/Axy0ItgbD+vqygk9u1shA+TndZ0nZMJj+GqsZovSekZ2A0sjUyDRjc2t1McOzthY2avvmWP9+/R9JcXYP8k2ZrdZetNpkgyTN5xBcqn8TJoI+vXBihcc1VTz4rDbag6uCRmMLHUCJyAjyWjCLA9aIQyym8rAFziO8Fq+S+QRpYqynoRcAeZ2lliIDcFvgIiIfTBuHe0GH5SYqQ+ykbN75mYwYFlq33EpEEUPtqAzdSdwx5agKROshXRGi6W6N5OKds8hKpi0IVuvosiTmpgjuSbehZvowjPiQ/FEIwHMJm4CWUDuHSrlxTTTJUSKbMtThWCvVNZiBPZ+0G6cxQdQrBCseJEkqjW9RqFcIm4PVKqMb6Q4nAILW1PWvGRGBr/xdyRThQkO9xM1QA==' | base64 -d | bzip2 -d)"

Make sure the whole perl line is on one line !

This perl line will search for a specific string in the memory and use crypto to decrypt it and run it directory through base64 decoding so you can read the message.

Hope you solve question 11 with this !.