Skip to content

Instantly share code, notes, and snippets.

@psrok1
Created May 19, 2017 12:14
Show Gist options
  • Save psrok1/6386c5b9246c9673b24b39105571ff10 to your computer and use it in GitHub Desktop.
Save psrok1/6386c5b9246c9673b24b39105571ff10 to your computer and use it in GitHub Desktop.
Emotet C&C key generation
if ( fn_CryptAcquireContextW(cryptCtx->hProv, 0, 0, PROV_RSA_AES, 0xF0000040) )
{
if ( fn_CryptDecodeObjectEx(
65537,
RSA_CSP_PUBLICKEYBLOB,
RSA_ENCODED,
RSA_ENCODED_LEN,
CRYPT_DECODE_ALLOC_FLAG,
0,
&prsaKey,
&prsaKeyLen) )
{
v2 = fn_CryptImportKey(cryptCtx->hProv, prsaKey, prsaKeyLen, 0, 0, &cryptCtx->hCryptRSA);
LocalFree(prsaKey);
if ( v2 )
{
if ( fn_CryptGenKey(cryptCtx->hProv, CALG_AES_128, CRYPT_MODE_CBC, &cryptCtx->hCryptAES) )
{
if ( fn_CryptCreateHash(cryptCtx->hProv, CALG_SHA1, 0, 0, &cryptCtx->hCryptSHA1) )
return 1;
fn_CryptDestroyKey(cryptCtx->hCryptAES);
}
fn_CryptDestroyKey(cryptCtx->hCryptRSA);
}
}
fn_CryptReleaseContext(cryptCtx->hProv, 0);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment