sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex ... - CrySyS Lab

for i=0..15:
take all characters from file at n*16+i
generate statistics on characters
key[i]=find most common character
for i=0..filesize:
decrypted[i]=encrypted[i] XOR key[i%16]
Figure 21 –Encryption E6A – TO691 1 st stage generic decryption pseudocode
The decrypted text after E6A is still not cleartext database format, but one can easily see
that it is very similar to the file format of audcache.dat (after decryption).
The second stage is a mono-alphabetical substitution, for which it may not be impossible to
find a short mathematical formula to calculate the substitutions, but so far we were not able
to find that. Instead, we manually investigated the file and built a partial substitution table
on the characters used. The partial table is denoted as E6B in Figure 22.
Laboratory of Cryptography and System Security (CrySyS)
Budapest University of Technology and Economics
www.crysys.hu 30