Michael Lazin via plug on 12 May 2022 08:32:18 -0700


[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Converting ascii into Cyrillic


Thanks everyone.  I have already converted it from base64 but I want to convert the output into Cyrillic Russian which I believe should be the language actually used for the variable names because I have good reason to believe that the script came from the Revil ransomeware group and I feel I may understand the script if I translate the variables into something meaningful which most likely would require transcribing it back to Russian and translating it.  The variable names were easily recognizable as base64.  That is not the hard part.  Thanks for the help.

On Thu, May 12, 2022 at 11:06 AM Randall Detra <rdetra02@gmail.com> wrote:
Probably not likely but is it possible this encrypted content is that of an audio or image file?  I use Base64Guru.

Randall Detra

On Thu, May 12, 2022 at 9:54 AM Michael Lazin via plug <plug@lists.phillylinux.org> wrote:
I have gotten my hands on what I believe is a base64 encoded script from the Revil ransomware group and only the variables are encrypted and when I decrypt them I get random ascii characters that if I am right should be convertible into Russian so I can see the variable names, but I don’t know how to convert them.  Can someone please give me a recommendation on how to do it with Linux?

Thanks again for your help.

Michael Lazin 
--
Michael Lazin

.. τὸ γὰρ αὐτὸ νοεῖν ἐστίν τε καὶ εἶναι.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug
--
Michael Lazin

.. τὸ γὰρ αὐτὸ νοεῖν ἐστίν τε καὶ εἶναι.
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug