There are some common APIs that are used to provide access to both symmetric and asymmetric algorithms, including DES, AES, RSA, and even RC4 encryption. Some of these APIs are CryptAcquireContext, CryptCreateHash, CryptHashData, CryptEncrypt, CryptDecrypt, CryptImportKey, CryptDestroyKey, CryptDestroyHash, and CryptReleaseContext (from Advapi32.dll).
Here, we will take a look at the steps malware has to go through to encrypt or decrypt its data using any of these algorithms and how to identify the exact algorithm that's used, as well as the secret key.