Vawtrak implements a quite simple encryption algorithm. It's based on sliding key algorithm principles and uses subtraction as its main encryption technique. Its encryption looks like this:
Figure 30: Encryption loop in Vawtrak malware
The encryption algorithm consists of two parts:
- Generating the next key: This generates a 4-byte number (called a seed) and uses only 1 byte of it as a key:
seed = ((seed * 0x41C64E6D) + 0x3039 ) & 0xFFFFFFFF
key = seed & 0xFF
- Encrypt data: This part is very simple as it encrypts the data using data[i] = data[i] - eax.
This encryption algorithm is used to encrypt API names and DLL names, so after decryption, the malware can load the DLL dynamically using an API called LoadLibrary, which loads a library if it wasn't loaded or just gets its handle if it's already loaded (you may also see GetModuleHandle, which only gets the handle of the already loaded DLL).
After getting the DLL address, the malware...
