Crypto-Analysis of keylogger logs and config file. Possible?

Question

Is there any way to break the encryption on an unidentified file? The files in question are the config and log files from Ardamax keylogger. These files date back to 2008.

I searched everywhere, nothing on slashdot, nothing on google. Ardamax Keyviewer? Should I just write to Ardamax? I am at a loss of what to do. I feel compromised. Has anyone managed to decrypt files like this with cryptanalysis?

More Information:

There are log files in the folder and a configuration file, "akv.cfg". Is it possible to decrypt the files and maybe getting the attackers email address used to receive the keylogger logs?

I've checked ardamax.com. They have a built-in log viewer, but it's unavailable for download. If superuser isn't the proper place to ask, know where I might get help?

Answer 1

If the keylogger encrypted the data, it will likely have the encryption key stored locally. Assuming a symmetric algorithm, if you can find the key, you can decrypt the file. If the logger is using an asymmetric encryption algorithm, well, find the encryption key tells you nothing. I'd bet on the encryption being symmetric, though, because asymmetric takes a lot more CPU.

If you can, watch what system activity happens when the keylogger is started. On windows, for example, monitor the registry reads, filesystem reads, and such. The key may be stored inside the program file, and if so, then you'll have an interesting challenge to figure out the key. If you want to find the attacker, let the logger start up and watch the network traffic. I'd bet no matter how the program phones home, that phone will be some sort of anonymous drop. But you never know, you might get lucky!

Answer 2

I would capture the Live RAM when you know the keylogger is running and use volatility to search for the encryption key.

After checking google, I found:

Site: https://www.alienvault.com/open-threat-exchange/blog/set-up-your-keylogger-to-report-by-email-bad-idea-the-case-of-ardamax

What about the encrypted configuration file?

We have seen some people infected by this keylogger wondering how to decrypt the file to see where is the malware leaking information to. Well, if you can not do memory analysis or some debugging it is quite easy to decrypt.

After a quick cryptanalysis of the file, it is quite obvious that it is encrypted with XOR cipher or something similar. You can easily decrypt it by using a XOR analysis tool like xortool. Let’s give a try:

$ python xortool.py -b keylogger/RKJ.00

xortool will generate some output files with possible decryptions. In this case the 33rd file was the good shot, encrypted with key “Z|NY”. If we open it with an editor, we can see all configuration parameters and reporting credentials in plain text.

Take care of the channels you allow on your network! We have seen how Google do a great job on cancelling accounts of this kind, but we should never have a blind faith on a legit connection because it could be a potential way to leak private information to the outside. - See more at: https://www.alienvault.com/open-threat-exchange/blog/set-up-your-keylogger-to-report-by-email-bad-idea-the-case-of-ardamax#sthash.ixStEibe.dpuf