There are other ways to implement these encryption algorithms. One of them is by using Cryptography API: Next Generation (CNG), which is a new set of APIs that have been implemented by Microsoft. Still not widely used in malware, they are actually much easier to understand and extract information from. The steps for using them are as follows:
- Initialize the algorithm provider: In this step, you can identify the exact algorithm (check MSDN for the list of supported algorithms):
BCryptOpenAlgorithmProvider(&hAesAlg, BCRYPT_AES_ALGORITHM, NULL, 0)
- Prepare the key: This is different from preparing a key in symmetric and asymmetric algorithms. This API may use an imported key or generate a key. This can help you extract the secret key that's used for encryption, like so:
BCryptGenerateSymmetricKey(hAesAlg, &hKey, pbKeyObject, cbKeyObject, (PBYTE)SecretKey, sizeof(SecretKey), 0)
- Encrypt or decrypt data: In this step, you can easily...
