Learning Malware Analysis

2.4 Decrypting In Python

After you have identified the encryption algorithm and the key used to encrypt the data, you can decrypt the data using the PyCryto (https://www.dlitz.net/software/pycrypto/) Python module. To install PyCrypto, you can use apt-get install python-crypto or pip install pycrypto or compile it from the source. Pycrypto supports hashing algorithms such as MD2,  MD4, MD5,  RIPEMD,  SHA1, and SHA256. It also supports encryption algorithms such as AES,  ARC2,  Blowfish,  CAST,  DES,  DES3 (Triple DES),   IDEA,  RC5 and ARC4.

The following Python commands demonstrate how to generate MD5, SHA1, and SHA256 hashes using the Pycrypto module:

>>> from Crypto.Hash import MD5,SHA256,SHA1>>> text = "explorer.exe">>> MD5.new(text).hexdigest() ...