Mode 11300

[philsmd]

the padding is known, we exploit this (padding attack, last few bytes 16 or 8 depending on the wallet type):

https://github.com/hashcat/hashcat/blob/...#L340-L352

or course you need to decrypt the full last blocks with the correct padding (not removing/replacing the padding, "none") to get the full decrypted block and see what the padding bytes are