복호화 가능한 iswr 랜섬웨어 국내 유포중

import sys
import os
import ctypes

key = ""
keyBox = []

suc_cnt = 0
fail = []

def genKeyBox():
    global key, keyBox
    
    k_arr = []
    
    for i in range(0, 256):
        keyBox.append(i)
        k_arr.append(key[i % 6])

    num = 0
    for i in range(0, 256):
        num = (num + keyBox[i] + ord(k_arr[i])) % 256
        keyBox[i], keyBox[num] = keyBox[num], keyBox[i]


def decrypt(filePath):
    global keyBox, suc_cnt, fail
    
    keyBoxCp = keyBox[:]
    
    file_ori = filePath[0:-5]
    
    try:
        fr = open(filePath, mode='rb')
        
        data = fr.read()
        
        num = 0
        num2 = 0
        res = bytearray()
        
        for i in range(0, len(data)):
            num2 = (num2 + 1) % 256
            num = (num + keyBoxCp[num2]) % 256
            keyBoxCp[num], keyBoxCp[num2] = keyBoxCp[num2], keyBoxCp[num]
            num3 = keyBoxCp[(keyBoxCp[num2] + keyBoxCp[num]) % 256]
            res.append(num3 ^ data[i])

        fr.close()

        fw = open(file_ori, mode='wb')
        fw.write(res)
        
        fw.close()
        
        os.remove(filePath)
        
        suc_cnt += 1   
    except Exception as e:
        fail.append(filePath)


def search_dir(path):
    num = 0
    
    for (root, dirs, files) in os.walk(path):
        for file in files:
            if file[-5:]==".iswr":
                num += 1
    
    if num == 0:
        return
        
    print("[+] Number of encrypted files : " + str(num) + "\n")
    
    cnt = 0
    
    for (root, dirs, files) in os.walk(path):
        for file in files:
            if file[-5:]==".iswr":
                cnt += 1
                print("\r[+] Progress : %0.1f%% (%d/%d)"%(cnt / num * 100, cnt, num), end='')
                filePath = os.path.join(root, file)
                decrypt(filePath)

    
def help():
    print("Usage : decryptor.py [Personal_ID] [Recovery_Directory_Path]\n")
    print("Personal_ID : Personal ID at the bottom of the ransom note (44 characters)")


def main():
    global key, suc_cnt, fail
    print("iswr Decryptor v1 by ASEC Analysis Team\n")
    
    arg = sys.argv
    
    if len(arg) < 3:
        print("[-] Invalid parameter\n")
        help()
        return

    if len(arg[1]) != 44:
        print("[-] Invalid Personal ID\n")
        help()
        return
        
    if os.path.isdir(arg[2]) == False:
        print("[-] Not exist directory\n")
        help()
        return

    print("[+] Personal ID : " + arg[1])
    
    key = arg[1][-6:]
    
    print("[+] Key : " + key + "\n")

    genKeyBox()

    search_dir(arg[2])
    
    total = suc_cnt + len(fail)
    
    print("\n[+] Total : " + str(total) + " / Success : " + str(suc_cnt) + " / Fail : " + str(len(fail)) + "\n")
    
    if len(fail) > 0:
        print("[-] Fail list\n")
    
        for failFile in fail:
            print(failFile)
    
    print("\n[+] End")
        
    
main()