openssl AES256 with a common standardized Password-Based Key Derivation Function

[derlange2k]

Examples:

encrypted key backup file from multibit:

Code:

U2FsdGVkX1/Gt5+4m/DQUaahjZ1bZvpbehbiJ8RlZgScHycsuhU6vxfLMpWR1LSHoTJma6igo6eG
CnMqbPYXw9drUjK3BZ2Qo1ZVvWD8pLcaIPM3rcTLAouZjurxZE32

hash generated by multibit2john.py:

Code:

hashcat-20200128133332.key:$multibit$1*c6b79fb89bf0d051*a6a18d9d5b66fa5b7a16e227c46566049c1f272cba153abf17cb329591d4b487

Decrypting with openssl: (i've had to add -md md5, otherwise my openssl would use sha1):

Code:

openssl enc -d -p -aes-256-cbc -a -in hashcat.key -md md5 -out hashcat-decrypt.key -pass pass:test

Code:

*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
salt=C6B79FB89BF0D051
key=1D7E307669F6D7224294C3A69BAFD9B94771F74805E97EB8D61CE78878780444
iv =480A54B1CA593A0BDBA73B3072492B1F

out file from openssl:

Code:

KzWpNf4JJC8StHZE9nYtQZpXbhDyxWypxKBUaZMcBEJSZ2oYTiZd 2020-01-21T21:58:35Z

unencrypted key backup from multibit:

Code:

# KEEP YOUR PRIVATE KEYS SAFE !
# Anyone who can read this file can spend your bitcoin.
#
# Format:
#  <Base58 encoded private key>[<whitespace>[<key createdAt>]]
#
#  The Base58 encoded private keys are the same format as
#  produced by the Satoshi client/ sipa dumpprivkey utility.
#
#  Key createdAt is in UTC format as specified by ISO 8601
#  e.g: 2011-12-31T16:42:00Z . The century, 'T' and 'Z' are mandatory
#
KzWpNf4JJC8StHZE9nYtQZpXbhDyxWypxKBUaZMcBEJSZ2oYTiZd 2020-01-28T12:36:13Z
# End of private keys

So it is for sure MD5 used. I simply don't know how to use it with hashcat. Any help would be really cool.