Low again in our last video.
We right at the crypt door for the files affected by the second round somewhere
let's open eyes up it'll
in case you forgot.
Let's hear again how the obfuscation routine looks like and see which bites are modified
will identify the right file call and from there.
See how the file point thirty is advanced and when will the obfuscation stop.
A few comments.
They will be very use for later
the maximum offset to be encrypted is five thousand sixty four hex twenty thousand five hundred eighty
decimal.
So it only modifies the files up to this position
and after each byte modified it will jump two thousand forty eight bytes forward which means 800 x
plug.
All this information into the descriptor script and we are ready to go.
The source is attached in the resources section
as before with test on encrypted file that initially contained only null bytes
the ransomware appends the DOT correct or extension to the modified files
that the creator will add the dots that extension lets make sure it works and we got back our original
file as before.
We can do a comparison and see how we stand
don't forget to practice this on your own virtual machine.
Remember practice makes perfect.
So the files are identical.
And this is our lecture.
Thank you very much for watching.