Timeline for Difficulty decrypting LCG string
Current License: CC BY-SA 4.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 26, 2019 at 18:25 | vote | accept | lll | ||
| Apr 26, 2019 at 13:47 | answer | added | Johann Aydinbas | timeline score: 3 | |
| Apr 26, 2019 at 9:51 | history | edited | lll | CC BY-SA 4.0 |
added 530 characters in body
|
| Apr 26, 2019 at 9:49 | comment | added | lll | Sorry, I was not clear. The decryption algorithm is provided as the appropriate function by the article I am following. Yes, the body of the HTTP message is decrypted using an RC4 key. The RC4 key is encoded within the PHPSESSID cookie. I believe, based on what I read in the article, that the RC4 key is decrypted using this PRNG function.It may be that the PRNG function is not the correct function for this - I can't get it to work. I just want to know how the encoded PHPSESSID is becoming the decoded PHPSESSID. | |
| Apr 26, 2019 at 8:38 | comment | added | Johann Aydinbas | You may have misread the blogpost? Vawtrak used an LCG but is now using RC4. Your screenshot even shows "RC4 key". It also mentions traffic is LZMA-compressed sometimes. Your example is definitely from the updated version while it seems you are trying to decrypt it using the old method. | |
| Apr 26, 2019 at 8:00 | history | asked | lll | CC BY-SA 4.0 |