SHOW:
|
|
- or go back to the newest paste.
| 1 | I don't have any clue of encryption and such... but here are some clues i found while analysing files manipulated by cryptorbit: | |
| 2 | ||
| 3 | - | 1. Fist Look: |
| 3 | + | 1. First Look: |
| 4 | ============= | |
| 5 | ||
| 6 | Cryptorbit does 3 things to the file: | |
| 7 | ||
| 8 | 1. Changes the first 512Bytes of the File (Header). The new header is always exactly the same (at least on the machine i examined) | |
| 9 | 2. Changes the last 512Bytes of the File ('Footer 1').
| |
| 10 | 3. Adds 512Bytes to the end of the File ('Footer 2').
| |
| 11 | ||
| 12 | 2. Comparing files: | |
| 13 | =================== | |
| 14 | ||
| 15 | 2.1: First hint: | |
| 16 | ---------------- | |
| 17 | XOR the first Byte of the Original Header with the first Byte of the Encrypted 'Footer 2' is always "0xC3". | |
| 18 | ||
| 19 | Examples: | |
| 20 | ||
| 21 | Orig Header Footer 2 XOR Value | |
| 22 | ----------------------------------------- | |
| 23 | 2D EE C3 | |
| 24 | 31 F2 C3 | |
| 25 | D0 13 C3 | |
| 26 | ... | |
| 27 | ||
| 28 | ||
| 29 | 2.2: Second hint: | |
| 30 | ----------------- | |
| 31 | - | I compared to files with almost identical original header and footer (First and last 512Bytes). In the coresponding encrypted files |
| 31 | + | I compared two files with almost identical original header and footer (First and last 512Bytes). In the coresponding encrypted files |
| 32 | i first thougt, that 'Footer 2' is identical. I found that both encrypted 'Footer 2''s beginn to differ, where the Header of the Original Files beginn to differ. | |
| 33 | ||
| 34 | Original Files | |
| 35 | ||
| 36 | File A File A | |
| 37 | --------- --------- | |
| 38 | Header |AAAAAAA| |AABBBBB| Header differs after Byte no. 0x200 | |
| 39 | --------- --------- | |
| 40 | | | | | | |
| 41 | | | | | | |
| 42 | --------- --------- | |
| 43 | Footer | | | | | |
| 44 | --------- --------- | |
| 45 | ||
| 46 | Encrypted Files | |
| 47 | ||
| 48 | File A File A | |
| 49 | --------- --------- | |
| 50 | Header |ABCDEFG| |ABCDEFG| Always the same... | |
| 51 | --------- --------- | |
| 52 | | | | | | |
| 53 | | | | | | |
| 54 | --------- --------- | |
| 55 | Footer 1 |fghijkl| |mnopqrs| Seems to be 'random' | |
| 56 | --------- --------- | |
| 57 | Footer 2 |XXXXXXX| |XXYYYYY| Differs after Byte no. 0x200 (Same place as header of orig. File..) | |
| 58 | --------- --------- | |
| 59 | ||
| 60 | ||
| 61 | Please drop a line on pastebin for hints and comments and include the following string, so everyone can find them: | |
| 62 | String: "cryptorbit-investigation@pastebin" | |
| 63 | ||
| 64 | Thanks for reading! |
