Decrypt an encoded string, answer provided

Question

It's more important about what the cipher is. These are from a Russian banking phishing campaign that has been active recently and is making news. They encode the e-mail address in the url using some sort of cipher.

Here is what we have to work with:

pghafari

That is the decrypted string. Here it is encrypted:

WFGNGLQz

Here is a key that they provide in the URL, but I'm unsure if it's useful:

4tAT0

There was also another link with a different key, but same value

32

What we also know. Here are some of our findings that might point to what the cipher is:

1. Numbers are always replaced with symbols
2. Symbols are always replaced with numbers.

However, there are some weird things. Sometimes these rules aren't followed, but generally are. Sometimes the encrypted string isn't the same between messages.

We're leaning on some sort of base64 variation currently.

Here are some more that have the same sort of alphabet and base:

(row corresponds between decrypted and encrypted)

Decrypted:

chris

bill

allan

christina

Encrypted:

FAQzN

GzTt

BqYJV

FAQzRQTOa

Some keys:

7XAp8

2oi7h

I wouldn't look too much into the keys, it's probably for their tracking.

Answer 1

Some more loose observations:

The fact that the encodings for chris and christina coincide for the first four letters, but not for the common s after that leads me to believe that the encodig is for letter pairs.

This assumption means that is (in chris/tina) encodes to z; ri (in_pghafari_ and chris/tina) encodes to Q. I also assume that the pairs wrap, so that the N in chris encodes sc and the R in christina encodes st.

If that is true, we don't have a one-to-one relationship, because both ri and ti encode to Q, both is and ip encode to z and both gh ad ch encode to F.

This last observation could be explained with a shifting of representations across letter/character borders. Imagine an alphabet of 64 symbols which we can encode in six bits. (OP mentions base-64 as working theory, so that might fit, but the alphabet could be something else, of course, such as 81 characters encoded with four ternary "bits".) These bits can now be shifted two bits to the left, for example. Shifting wraps: bits that are shifted out to the left reappear at the right.

            c      h      r      i      s             plaintext
            cccccc hhhhhh rrrrrr iiiiii ssssss        bitwise
            ccchh  hhhhrr rrrrii iiiiss sssscc        after shifting
            F       A     Q      z      N             ciphertext

Unfortunately that nice theory falls flat, because ll (ell ell) is encoded as T in bill and as q in allan. (Well, the idea could still be true if the represetation of a plain byte spread over more than two bytes. With only a few examples and without even knowing the source and target alphabets, trying to find a match here will be quite difficult, I imagine.)

Answer 2

Here's a partial answer that may be of some help to someone:

The length seems to be the same for the plain text and the encrypted text, so it's very likely a substitution cipher. Looking at repeated letters, there aren't that many in the plaintexts, and neither are there very many in the ciphers.

In the longer ones the repeated letters, correspond, if you

reverse the plaintext before substituting.

and you'll have to ignore the shorter ones, sadly.

Also, this theory more or less falls apart on the chris-christina similarity. Might just as well post though, since either way, there's a coincidence going on there.