2.4 Decrypting In Python

After you have identified the encryption algorithm and the key used to encrypt the data, you can decrypt the data using the PyCryto (https://www.dlitz.net/software/pycrypto/) Python module. To install PyCrypto, you can use apt-get install python-crypto or pip install pycrypto or compile it from the source. Pycrypto supports hashing algorithms such as MD2MD4MD5RIPEMD SHA1, and SHA256. It also supports encryption algorithms such as AESARC2BlowfishCASTDESDES3 (Triple DES),   IDEARC5 and ARC4.

The following Python commands demonstrate how to generate MD5, SHA1, and SHA256 hashes using the Pycrypto module:

>>> from Crypto.Hash import MD5,SHA256,SHA1>>> text = "explorer.exe">>> MD5.new(text).hexdigest() ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.