A
A
Ariurn2020-03-28 04:15:38
Cryptography
Ariurn, 2020-03-28 04:15:38

How to decrypt the specified data?

Hello! There is the following data in encrypted form (what is black):
5e7ea371a46d4637114718.png
Here is the black part in base64 format:

eJxFjctqwzAURP/lrq33tWJrGbLstt0WPa5jgyMVSaGFkH+vuyhZDRzmzDyAagUnh7+8tSu4fN/3AZLvHtwDPqi2rWRwIPnMDVdyPMEAq2/rwSwqklFZqy2aYAymlMIyjZFQj4j2aF7Kd96LT+91O4S19y8nREyZKcVp6az1UonHchNv/p7jSvWytV630MTr8XNWRuI8a4YYJoY6eea1JjYHY09xkTTpJM7t+r/BXy6nH4Ln8xd/QESc

The above data is known to be the result of AES-(128/192/256) encryption. Also, the following base64 string was extracted from the .exe, which can decrypt this data:
WT+fY3IKPLVJDEszF6MCAUnXPg9zSXR7JVQ0sT1rbhy/fG9dBhVoNbJcMzcLTRSOQE47R2V0VHlwZUZfb21IYW5kbGU7AWV0X05hbWU7SW5kZXhPZjtFeGl0O2dldF9GcmFtZUNvdW50O2dldF9MZW5ndGg7UmVhZFN0cmluZztBZGQ7Z2V0X1Bvc2l0aW9uO2dldF9DdXJyZW50RG9tYWluO1NldERhdGE7UnVudGltZU1ldGhvZDtTeXN0ZW0uRGlhZ25vc3RpY3MuU3RhY2tUcmFjZTtTeXN0ZW0uRGlhZ25vc3RpY3MuU3RhY2tGcmFtZTszNDI3MjtTeXN0ZW0uRW52aXJvbm1lbnQ7ZGU0ZG90O1NpbXBsZUFzc2VtYmx5RXhwbG9yZXI7YmFiZWx2bTtzbW9rZXRlc3Q=

After decoding it, the following data set was obtained:
Y?\x9fcr\n<\xb5I\x0cK3\x17\xa3\x02\x01I\xd7>\x0fsIt{%T4\xb1=kn\x1c\xbf|o]\x06\x15h5\xb2\\37\x0bM\x14\[email protected];GetTypeF_omHandle;\x01et_Name;IndexOf;Exit;get_FrameCount;get_Length;ReadString;Add;get_Position;get_CurrentDomain;SetData;RuntimeMethod;System.Diagnostics.StackTrace;System.Diagnostics.StackFrame;34272;System.Environment;de4dot;SimpleAssemblyExplorer;babelvm;smoketest

It is likely that the piece at the beginning is related to the key (not sure if this is part of the decoded string):
Y?\x9fcr\n<\xb5I\x0cK3\x17\xa3\x02\x01I\xd7>\x0fsIt{%T4\xb1=kn\x1c\xbf|o]\x06\x15h5\xb2\\37\x0bM\x14\[email protected]

Please help me find the key! Namely: to extract the key from all this, so that it can be used to successfully decrypt the data encrypted above. Thanks in advance!

Answer the question

In order to leave comments, you need to log in

1 answer(s)
S
Saboteur, 2020-03-28
@saboteur_kiev

And in general, you already have an http package.
Handshake goes on several levels, a little lower.
Read for example https://tls.dxdt.ru/tls.html

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question