What is encryption software used by Antti Tikkanen?
![Arduinu](https://community.f-secure.com/applications/dashboard/design/images/defaulticon.png)
Comments
-
-
-
-
It doesn't come from the MTV3 it came YLE view it here : http://areena.yle.fi/video/1320346677150 look forward 11.10.
-
-
-
Hi!
In your screenshot I'm decrypting an embedded, encrypted program from the original sample. The tool you see is Immunity Debugger (http://immunityinc.com/products-immdbg.shtml). However, it isn't quite as straightforward as taking a malware sample and asking Immunity Debugger to decrypt it. In this case, I analyzed the sample a bit and found the decryption loop, and what you see is me stepping the malware though this loop. So you actually need to understand a bit about how the malware in question works to do this.
The other tool you see in the clip is the HIEW hex editor (http://www.hiew.ru/). I used it to decrypt the URL in the sample. For this to work, I had to reverse engineer the sample to recover the decryption routine. I then implemented the routine into HIEW to decrypt the string.
Hope this helps,
Antti
-