# How to detect what crypto-method is used by Filecoder.Q?

I have 2 different images, one original, and one locked by a malware detected by eset as "Win32/Filecoder.Q".

How to detect the encryption method that is used and the key, that is not using any public key/rsa/rc4 algorithm. There is diff:

If needed I can attached files (locked and original).

• Why is there a short red line between yvc and .O° for the locked file? ​ ​ – user991 Apr 24 '16 at 6:24
• @RickyDemer It's a delimited to show that file headers are not touched (i draw it) – Daniel Apr 24 '16 at 6:25
• Why do you say "not using" "RSA/RC4"? How do you know that? Also, even if it is using a symmetric algorithm, the key is probably not in the encrypted file, so looking at it does not help. – otus Apr 24 '16 at 6:34
• @otus because it's a scriptkiddy realisation. Having these files can't find key anyway? – Daniel Apr 24 '16 at 6:40
• @Daniel probably not. See related questions about CryptoLocker and CryptoWall. – otus Apr 24 '16 at 6:54