Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is there any way to break the encryption on an unidentified file? The files in question are the config and log files from Ardamax keylogger. These files date back to 2008.

I searched everywhere, nothing on slashdot, nothing on google. Ardamax Keyviewer? Should I just write to Ardamax? I am at a loss of what to do. I feel compromised. Has anyone managed to decrypt files like this with cryptanalysis?

More Information:

There are log files in the folder and a configuration file, "akv.cfg". Is it possible to decrypt the files and maybe getting the attackers email address used to receive the keylogger logs?

I've checked ardamax.com. They have a built-in log viewer, but it's unavailable for download. If superuser isn't the proper place to ask, know where I might get help?

share|improve this question
add comment

1 Answer 1

If the keylogger encrypted the data, it will likely have the encryption key stored locally. Assuming a symmetric algorithm, if you can find the key, you can decrypt the file. If the logger is using an asymmetric encryption algorithm, well, find the encryption key tells you nothing. I'd bet on the encryption being symmetric, though, because asymmetric takes a lot more CPU.

If you can, watch what system activity happens when the keylogger is started. On windows, for example, monitor the registry reads, filesystem reads, and such. The key may be stored inside the program file, and if so, then you'll have an interesting challenge to figure out the key. If you want to find the attacker, let the logger start up and watch the network traffic. I'd bet no matter how the program phones home, that phone will be some sort of anonymous drop. But you never know, you might get lucky!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.