0

So my uni just had some on break into the email server and send out a load of emails with a suspicious looking executable. I'm on Linux so I downloaded the file and ran the Strings command and saw a call to the Kernel and a hand full of other functions, but all the other strings looked like this.

CJ6ITqV47cdsqv4YNvthhunl7ULJcKxC7VXMuGyBQnjzQbztx1VPnJ626d8tX8GlZuTtAxNSYSaHFWyfjzU53w3Wk2rpDYAYe3DGWO0pL8mGRUjtchFnhWrtfsgRwM541yFF829DFOE2+HbKuG0O1n7HAgztKiFv45Dtl3ZhzUUuO2jn6O1zzF6EdYjlcOleyBHg6XADSOlxFzDtc145tO1xf5TabOZZONsN1WbS5VT1SUbO201+3Ubt8J7GtXP4bLKAquOhRu0M023oeyZ+p+w67Ulu9hg1g2MBJQ1tJoWsnXMnbI1uCfUwOor1eU3tVTa4J/rtVXCtZPLlGJF7bL6qyS643CzI7WfRkJXsk+QH2rLtgBB57Au870y46ZSGxH02Qu1WhZpl70rxLDcX40ytXsa1MWxHsKguvPzEJW5dW1dZmQxdpWwrF+QU+lF4fWzcFzpH45tN/W2nz9CEvsa30WyK1it/0p09RA7wIcvsa61Mi61PhW79fW71OUbxJWwtqA9Z1r6v3U/SMe6tfS2a7B1vq4DQ6J6knIlq7GXMulIWhZmlbyJHIa9d/XRtfHhprRMnD3xXVW37hxFA3fvWzWwijF2Gix71wW/KpMRa6EKnaW/lSHgEIf+t1W/0bPE2b7taOW7hXDdi+PROCW85bm1JuCHt0W3Gax9/yRWpRW7w/E4J+YxcmW8+O34V7htQPW8wAHdRKw07FWzhH9iVfTvg1WXG7HMwANdr5Yhvb+jmgreSbM2hbK1XeXjNVsgRbxDaixTk2FWFbdss4+HO8Kgt7B9YoUbz7Ha6rW8/bI3p76YfsW1gr8+3tXry2W9c8J6fITnSxW42chLnlNDAMW36n7eAIUE71W8ivM6pBN3rs29Xb8yBI6OwLDFsc6xvkA2q4B1suKBS+MVad2lu+M55PWOMXJluJG6S/qRuggl+4l+tMtx6zCEd7YVGS9/PoSd+BewAFsF4662RcJlppXe0HtpWszTVb8141yVFg24lb2XX5u1TFeTNbVcRX1rIIUE9b9GFxRn0O5nhbtYQIuBCp6Lxbht66yGPrIc9bTviM+71YGzdbBRsHN/O6jkxT8ycv6ExfkmLsW0tRvLahbzXzW8hziRvQ1f4sWzScuhCx1HzCW8KtxuZ6obY6W+0BDixtXjJVW03YutxabCe8W2FRirGtvPaZWxXmU79NUTWwezQ+G8mYyzwH2VtLhtEIWVeyJFtASQsKflX0JlsvH67aLbqCoVtmcRTUfFesNV/J5St+9viFRuxbXBvHZo3Y+aJb009ZKOPU/zNbIDXz/9VeYgNbsiRI4aFPsVxTywgv60xRZ9PbW/MhaVJEnxvOU8bmautT4MUONlsqK9c9T3i8tl/nMIo2IzYRZIZaa2P0fgihgUYXWzhN1P+vO6p9W0UONF6WuCj5X9q7K02AybCvA1u+oSBBLadUD1tsOlc/dkqQr1tSreQQ5ai/slu9hDQwBByu6Vvq3dpOoNvsJssk8zV96HoBQ6t5Txibq3wkrXm4x0tbocXE5mqc9sNbo4zyqT3VdrF7+VPsD1WKJ3EOW8Q0TZruXiNPe94KVbnRCy6gX1uvTn04PH9nBVvVfqGMuL7/1VtPvaBscyDjy1tLJEdeqWwaBFskToWXi0ku21s8JsW9eFAthVvVRqVOoOo9G3vSHSjjyCtK2xNb7tReM6oYGTdbsaDys2f4GTpbFYy08Kkx1ftb3hiVfVZcOZ1bKJynjkv3C2Bb7dVec9xPANRbsnc6TRqUJHZbTgfZA4bUNuNbUk1RQ+MO045bX2Hb/QvgBT7b+F4rEwMlUSs6W8UYwxXsJw9zW/FnuiY4lgoUW4BdtaexCEcqXyAmpHxc/b7LTFsdQbP1tpU4qXuPdg5SzUvTHExLqOZ5hFvHFbIkW5xJC0rGW63kWybDvXQrE6BKW8wglQZD4wptW7L26heJJP1zWw7wgqFGdSdXWq13GQfZO7y9W3saVU3otgrS9uZ72wOqQYepNi3GW5ntPRve+aDOX51963CEua3U/1vtpVK8tqnbJ1uiztsjHqEGqlprGcPeAI3vPQNb2sagpOYDRrtbPIRk1hW5tc1brUPCX3zOYJhbbQOoo7eK41B7lsiqsjsrEzMAW8a6N/p6NsbnW7os/wM4BzY4WzZwZAMd2sGWezQVFcU1s1xC519055jIIzZu6tZbilCeR10r+ldbQwP4RaMVUaZPfTFoWlFqWtvzOFvKxh6XOqsHs1uG4QZV/idg5FvQ9Ypi8/iP/BuP/KM7in5rWsZbFHzmbfr5p85TTnsXO0K7Xqa4U6UndCpZOMU1lFt2KFMaJbyDoVtmEc6VsNDzXFp7YN04AHNykPtb6V5G5Ulh2h1b1U+BkFfat6VbcHKy6OU4mOVbYuW80PWxOBdbMkLdyjj5gt9ZHHssTVE85w9r27LWvk5/9/64QFsFsiRoSQsSyFtj6hQmw41Mw1tkxl4z3Es7uFvgNDyy1krbI1t+kogthtehRluBsgSM6G36HVvzznQgsa2oLVsTgGptChCTtFtb3gl1uOQ0PFsXrCjoRKr7x1ubfbK9N1aPsxtAPV5gj6fr87pbN280PiWjjiTbdibY3t3sv0tpWQHLGLWzCFOb5FuwY/gFPgDQ3lu+Dk3Y+ZbVwlnzKllNPgU+8FhbWkPcCOUxsi5bswgfFVdyJpNbjnvsjV3DM+Bb2Pl+bfrhKttb+P87GL+7WNFbDmMFHTux79VZ54t6rTOKkoEiWxOAJroQndpEc9xTY2laSm5aReFbkxxt+ucTVqlbA4Jxii27KgtbV/jAbfsGcZBbfmM0kHQeqObfdrV7StwInSvoWFuyHlL5jHtj01sIzAAVO5PuOFuR4MuQJXZOVVuIS4p+8zd6DVs3F+5dyn5jMltsAlyS3hGqv0sLax0Fa1oWXOZb+/iPRY62D5Vf6rOq6Ebs3A1QWWBrWi4oUzw1rFuVOJgNDVWT0Fv1UH371o8cSVpPwC3GoY921UdbScUzQt3LOPl7g4bd5zV7QEPjWyaxvZBerwtGW54hHUdQnkate8QUsOuYKkw9DduGTOAitrRKK01LOkDcX2tQdnH9S6UHOVPLIczgfUqL29WHYUvZIbGtW0QmbxIIWVwVW/vWtwfFGEvDWZgquWLko/c6iluPxWqvI+xnwVsVCNA7NDUElRtj/WGHK2aqv6VbMSEyOvxbxjlbPNb/nNFqHT5bfwMxs8gYLEJbcMuw6E/OW1tbX1trJ95IW8RiW0tOOXJ6W0E1x4tBV6BPWyhz1jrlmmYCX1NeWyfUk1AMWVpbR7o+h3YEEvRfxlpbd6UxITLFWzbmB5iKZFRpW1UTxwlafTLzWyGlA/fKtGZCW3DLzoSrq9pZ26qjU47rZSlalVtVTVG8tl46TVujniR2TviMe1vs1V4zV1Q+J1vf3jFJOY37XFsTVlQGNM7YO1tWfpGwQBoiUVtUIyXY2jIUKVvP8lBUGAL55FttCGPn0mhXVFs6ONLfMF85jVP6SBpbZTnZ2jJfCX9aV15XIiHZW9hcVzk0xMJxWxBVVywhzNo3W1ks1/dLGGHSW19XChToJlcAWz7G3zJWLIyrWwpGbtDbEoKxWzFEJm0f6JZoWxR8mMlrIXjMW6VbraUuXzAaWzTe/TdOYpatWxNYfc6sU6edWwp+GWFx0N81W19t5PtHHSHRW6w4hKcxXjBiW2WNmG4Uf5GpWxZYdsGsKI2zWz9BPGJkj4FwWwl7g9F0JGHKW7RV3PtvBGB9W3+Ijl5R6wspW3NVVyIz3cQ4W18uyOoKEzadW1VXJDLd2DZbWzfK7goVIZVZW1diXlHX2+BjW1BXYjTV2zkIW2PT8ENeUWcrWzUKXlE4Jsl1W15Rnh3P5F5RUyl3wdtTmymP5lteUUTTMeheUVvq81ftXlHbc1sH+V5RB5DWd1teUQElEu9eURNgERzbTCag2lDfX/GM20y47qB0XktRJbaX20p5CFJbmF5RbxApc15LUa98AJtTWJZuWptZAYZuc1JXf1tgjI4rUX+Ss1tBZwz3dE5+VttVW1tXflRLGlrxShlaSRlaSBlaTxla8U4ZWk0ZWkwZWkMZWvFCGVpBGVpAGVpHGVrxRhlaRRlaRBlaexla8XoZWnkZWngZWn8aWiQayWRbZFtkW2RbZFtRW1o3W0P7Wztb27ZZmiZrDqtZUjvcE3taO9tYJljaX1dbZ2QjNjd7Wy0+KSgyNDVmW3xqdWt8ez41Wzg0PzI1PGZ8Ww4PHXZjfHsoWy86NT86NzQ1Wz5mfCI+KHxkW2VWUWc6KCg+ezY5NyJ7W1M1KFtmfC4pNWEoOFszPjY6KHY2Mls4KTQoND0vdls4NDZhOig2dVstanx7Njo1Mjs9PigvDfJWG1J7W3tnLykuKC8SczU9NP9SeedSaHlYuV17XCg+OC4pMlcvIr9ae1kpPiouWvtXPj8LKTItMjs3Pjw+KN1YklgeUSMbXC9bShc+LT5TN3s3+ltmfDooWxI1LTQwPil8W3suMho4OD4oWjtAPTo3KD58exF03Fd07FdndDFJZy103UCafXS+fdtaRGVb

I don't know what it could be, possibly XOR encrypted? so just wondering do you guys know what it is and how I could go about decoding this?

  • 2
    Upload the executable, if possible. It's almost impossible to conclude how exactly it is encrypted/encoded without reversing the code working with the string - and I don't see here some obvious variants. It doesn't look like xor encrypted string because xor encryption usually creates non-readable bytes in the middle of the string. – w s Aug 25 '15 at 5:34
  • It looks like a base64 encoded string, which contains a byte array. Since some parts of this byte array contains repeating character sequences, it should be a simple encryption (if it is encrypted), such as XOR. – ebux Aug 25 '15 at 10:27
  • It's not base64. Decoding it with python gives incorrect padding error. – w s Aug 25 '15 at 10:36
  • If the executable is malicious I'd guess base64 with scrambled alphabet. Is there any string that looks like an alphabet, non necessarily ordered? – Andrea Biondo Aug 25 '15 at 15:40
1

It is almost impossible to provide any meaningful help here.

Either:

  • upload the actual executable,
  • or run it on a virtual machine on your side (log everything using strace),
  • or upload more of those strings to see if there is a pattern.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.