I have 2 different images, one original, and one locked by a malware detected by eset as "Win32/Filecoder.Q".

How to detect the encryption method that is used and the key, that is not using any public key/rsa/rc4 algorithm. There is diff:

original file locked file

If needed I can attached files (locked and original).

  • $\begingroup$ Why is there a short red line between yvc and .O° for the locked file? ​ ​ $\endgroup$ – user991 Apr 24 '16 at 6:24
  • $\begingroup$ @RickyDemer It's a delimited to show that file headers are not touched (i draw it) $\endgroup$ – Daniel Apr 24 '16 at 6:25
  • $\begingroup$ Why do you say "not using" "RSA/RC4"? How do you know that? Also, even if it is using a symmetric algorithm, the key is probably not in the encrypted file, so looking at it does not help. $\endgroup$ – otus Apr 24 '16 at 6:34
  • $\begingroup$ @otus because it's a scriptkiddy realisation. Having these files can't find key anyway? $\endgroup$ – Daniel Apr 24 '16 at 6:40
  • 1
    $\begingroup$ @Daniel probably not. See related questions about CryptoLocker and CryptoWall. $\endgroup$ – otus Apr 24 '16 at 6:54

Filecoder.Q ransomware used one of three encryption algorithms: XOR ,Tiny Encryption Algorithm(TEA) and AES,but this ransomware does not encrypt beginning of the files so in your picture beginning of original and locked file are equal.if this ransomware uses XOR Algorithm then you can decrypt locked file with XORing original file and locked file(key Extraction) else if it uses TEA Algorithm then decryption of file is hard(but possible),but decryption of file when it uses AES is impossible.

  • $\begingroup$ Why do you say decryption is possible with TEA? It is secure, AFAIK. Do you mean some kind of attack exploiting its small block size? $\endgroup$ – otus Apr 25 '16 at 4:53
  • $\begingroup$ I tried to find key, for XOR algorithm, but no success $\endgroup$ – Daniel Apr 25 '16 at 6:18
  • $\begingroup$ @otus i speak about some cryptanalysis of TEA like this link:schneier.com/cryptography/archives/1997/11/… $\endgroup$ – 0skar Apr 25 '16 at 9:33
  • $\begingroup$ @Daniel you should XOR bits of original file with equivalent bits of locked file and the result is key,or you can use ESET Filecoder.Q Cleaner $\endgroup$ – 0skar Apr 25 '16 at 9:40
  • $\begingroup$ @0skar, those are related key attacks, which are pretty much not useful in practice. $\endgroup$ – otus Apr 25 '16 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.