Etherum test wallet cant find password

[lokojones]

Hi there
I have few questions regarding etherum wallet. created test one with password: Password!

{"version":3,"id":"a9abfd0e-acd6-4f61-b94a-4e6218e3b545","address":"1b683d03d29ff1d5d5d4bab15b8ec1c686a04917","Crypto":{"ciphertext":"c8d2df24d8d41ae4ef5f94d446e42adeacb112e0c7c69bfd0548b277c999ee8d","cipherparams":{"iv":"06c00f278dbae15c7d70b6e7a2860701"},"cipher":"aes-128-ctr","kdf":"scrypt","kdfparams":{"dklen":32,"salt":"f6be6c9c0fbeeacc45f2ed5ade94cee9374a05e964988a5ff51434a3c7759c6a","n":1024,"r":8,"p":1},"mac":"e520ba417017fbaf6bedb529411aead55bd80f51e021b4db846950f92d0cec61"}}

and from that extracted hash with ethereum2john.py which use formula below

$ethereum$s*n*r*p*salt*ciphertext*mac

$ethereum$s*1024*8*1*f6be6c9c0fbeeacc45f2ed5ade94cee9374a05e964988a5ff51434a3c7759c6a*c8d2df24d8d41ae4ef5f94d446e42adeacb112e0c7c69bfd0548b277c999ee8d*e520ba417017fbaf6bedb529411aead55bd80f51e021b4db846950f92d0cec61

but this formula doesnt work with hashcat 4.0 (no hash loaded), but the other formula

$ethereum$s*n*r*p*salt*mac*ciphertext

works fine, but the hashcat cant find password which is in dictionary, tried:

C:\aa\Hashcat4.0>hashcat32.exe -m 15700 -a 0 -D 1 testwallet1.txt tempdic.txt
C:\aa\Hashcat4.0>hashcat32.exe -m 15700 -D 1 testwallet1.txt tempdic.txt
C:\aa\Hashcat4.0>hashcat32.exe -m 15700 -o recovered.txt -D 1 testwallet1.txt tempdic.txt

Dictionary cache hit:
* Filename..: tempdic.txt
* Passwords.: 13
* Bytes.....: 50
* Keyspace..: 13

Session..........: hashcat
Status...........: Exhausted
Hash.Type........: Ethereum Wallet, SCRYPT
Hash.Target......: $ethereum$s*1024*8*1*f6be6c9c0fbeeacc45f2ed5ade94ce...99ee8d
Time.Started.....: Thu Dec 07 12:18:37 2017 (0 secs)
 Time.Estimated...: Thu Dec 07 12:18:37 2017 (0 secs)
 Guess.Base.......: File (tempdic.txt)
 Guess.Queue......: 1/1 (100.00%)
Speed.Dev.#2.....:        0 H/s (2.85ms)
 Recovered........: 0/1 (0.00%) Digests, 0/1 (0.00%) Salts
Progress.........: 13/13 (100.00%)
Rejected.........: 0/13 (0.00%)
Restore.Point....: 13/13 (100.00%)
Candidates.#2....: z -> 
HWMon.Dev.#2.....: N/A

This wallet (original myethwallet file) and dictionary were tested with ethcracker and password was found.
Any ideas why this doesnt work?

[Chick3nman]

The hash in your example, ending in "61", seems to work just fine. Cracked immediately with hashcat.

[lokojones]

The hash in your example, ending in "61", seems to work just fine. Cracked immediately with hashcat.

Hi there, thanks for confirmation. My hashcat was corrupted, I just downloaded another copy and everythong is ok.

thanks again