Search

I have an AES256 key in hexadecimal "8A64E947DAA12B6B7761F30192219270883F24D358D55A1E98E5364B801E9120".

That key is encrypted in AES256 and have to decrypt the following key and initialization vector:

Key = "517565747A616C636F61746C5349495038383838383838382020202020202020"

IV = "00000000000000000000000000000000".

The result of the decryption must be a string of 64 characters (hexadecimal).

Bonjour,

Bon on arrive aux limites de mes compétences... Il me reste une solution, supprimer en passant par un autre système d'exploitation, mais c'est bien plus lourd et j'essaie de l'éviter... J'ai donc demandé des conseils, on va voir ce qui va revenir.

Dans tous les cas on va quand même si préparer en récupérant plus d'infos sur ton malware :

1) Peux tu exporter cette partie de ton regis...

Bonjour Chapi,

Voici le rapport attendu, croisons les doigts !

BlitzBlank 1.0.0.32

File/Registry Modification Engine native application DeleteDriverEntryOnReboot: driverName = "mpckpt", backupFile = "(null)", deactivateOnly = 1 DisableDriver: ZwSetValueKey failed: status = c0000022 DeleteDriverEntryOnReboot: driverName = "mpcprotectservice", backupFile = "(null)", deactivateOnly = 1 DisableD...

Ok. I create archive : qr31uzq3.default-1452596043026.rar, and I located here : https://up2sha.re/file?f=A8VrdUSZ8Ufb

Xplode, there is no sense to add this record to DB.

1) A modification of this miner was popular in 2013-2014 years. Current path today is very rare be found. Nowadays this virus was modified and it ads itself to legal soft folders.

2) Bitcoin miner - is not an adware and to clean it user have to use classic anti-virus program.

Thank you!

Hello,

This will be added with the next database update.

Regards,

Not new :-)) First submission 2013-05-27

https://www.virustotal.com/ru/file/fa8ffa2bce213681b245a53dbf1a03bb24ab796f50aca24d999a2e3e7b53bbdc/analysis/

not detected by last AdwCleaner

It is bitcoin miner.

http://rghost.ru/8ybcxv78x password: newvirus

Hello,

The link leads to a 403 "the action is not allowed, because the file is marked as private and the key you provided is not correct".. Can you fix it ?

Regards,