Keep up with Ransomware

#!/usr/bin/env python3

import argparse

import re

from pathlib import Path

from Crypto.Cipher import AES ## Requires separate installation via pip (pycryptodome).

RECOVERY_PREFIX = "GREEN-BLOOD-"

WARNING_LINES = (

"1. This tool only applies to files encrypted with .tgbg extension.",

"2. Back up your encrypted files before attempting decryption.",

"3. This script is provided as-is, without any warranty. The author is not liable for any issues, damages, or data loss.",

"4. Decryption may fail if Recovery ID or Machine ID values from the ransom note are altered or entered incorrectly.",

)

def parse_recovery_id(recovery_id: str) -> bytes:

token = recovery_id.strip()

if token.upper().startswith(RECOVERY_PREFIX):

token = token[len(RECOVERY_PREFIX):]

token = token.strip()

try:

return bytes.fromhex(token)

except ValueError as exc:

raise SystemExit("Recovery ID hex format is invalid.") from exc

def parse_machine_id(machine_id: str) -> bytes:

token = machine_id.strip()

machine = token.encode("ascii", errors="strict")

if len(machine) != 32:

raise SystemExit(f"Machine ID must be 32 ASCII bytes. Current length: {len(machine)}")

return machine

def parse_ids_from_ransom_note(note_text: str) -> tuple[str, str]:

recovery_id = None

machine_id = None

recovery_match = re.search(

r"(?im)\bRecovery\s*ID\b\s*[:=]\s*([A-Za-z0-9\-]+)",

note_text,

)

if recovery_match:

recovery_id = recovery_match.group(1).strip()

else:

fallback = re.search(r"(?i)\bGREEN-BLOOD-[0-9A-F]{64}\b", note_text)

if fallback:

recovery_id = fallback.group(0).strip()

machine_match = re.search(

r"(?im)\bMachine\s*ID\b\s*[:=]\s*([^\r\n]+)",

note_text,

)

if machine_match:

machine_id = machine_match.group(1).strip().strip("\"'[]()")

if not recovery_id:

raise SystemExit("Could not parse Recovery ID from ransom note.")

if not machine_id:

raise SystemExit("Could not parse Machine ID from ransom note.")

return recovery_id, machine_id

def load_ids_from_note_path(note_path_raw: str) -> tuple[str, str, Path]:

normalized = note_path_raw.strip().strip("\"'")

note_path = Path(normalized).expanduser()

if not note_path.is_file():

raise SystemExit(f"Ransom note file not found: {note_path}")

note_text = note_path.read_text(encoding="utf-8", errors="replace")

note_recovery_id, note_machine_id = parse_ids_from_ransom_note(note_text)

return note_recovery_id, note_machine_id, note_path

def xor_recover_key(recovery_bytes: bytes, machine_bytes: bytes) -> bytes:

if len(recovery_bytes) != 32:

raise SystemExit(f"Recovery ID payload length is not 32 bytes: {len(recovery_bytes)}")

if len(machine_bytes) != 32:

raise SystemExit(f"Machine ID length is not 32 bytes: {len(machine_bytes)}")

return bytes(recovery_bytes[i] ^ machine_bytes[i] for i in range(32))

def decrypt_aes_ctr_file(in_path: Path, out_path: Path, key: bytes) -> None:

with in_path.open("rb") as f:

iv = f.read(16)

ciphertext = f.read()

if len(iv) != 16:

raise SystemExit("Input file is too short. Could not read the 16-byte IV.")

initial_value = int.from_bytes(iv, byteorder="big")

cipher = AES.new(key, AES.MODE_CTR, nonce=b"", initial_value=initial_value)

plaintext = cipher.decrypt(ciphertext)

with out_path.open("wb") as f:

f.write(plaintext)

def output_path_from_encrypted(path: Path, extension: str) -> Path:

if path.name.lower().endswith(extension.lower()):

return path.with_name(path.name[: -len(extension)])

return path.with_suffix(path.suffix + ".decrypted")

def decrypt_folder(folder: Path, key: bytes, extension: str, recursive: bool) -> tuple[int, int]:

pattern = f"*{extension}"

files = sorted(folder.rglob(pattern) if recursive else folder.glob(pattern))

ok = 0

fail = 0

for enc_file in files:

out_file = output_path_from_encrypted(enc_file, extension)

try:

decrypt_aes_ctr_file(enc_file, out_file, key)

ok += 1

print(f"[OK ] {enc_file} -> {out_file}")

except Exception as exc:

fail += 1

print(f"[ERR] {enc_file}: {exc}")

return ok, fail

def prompt_nonempty(message: str) -> str:

while True:

value = input(message).strip()

if value:

return value

print("[!] Empty input is not allowed.")

def main() -> None:

print("[WARNING]")

for line in WARNING_LINES:

print(line)

parser = argparse.ArgumentParser(

description="Recover AES-256 key from Recovery ID + Machine ID, then decrypt AES-CTR file(s)."

)

parser.add_argument("-r", "--recovery-id", help="Example: GREEN-BLOOD-<64hex>")

parser.add_argument(

"-m",

"--machine-id",

help="32-byte ASCII string (example: 6F707172737475767778797A7B7C7D7E)",

)

parser.add_argument("--note", help="Ransom note file path for auto-parsing Recovery ID and Machine ID")

target = parser.add_mutually_exclusive_group(required=False)

target.add_argument("-i", "--input", help="Encrypted file path")

target.add_argument("-d", "--dir", help="Folder path for batch decryption")

parser.add_argument("-o", "--output", help="Output file path for single-file decryption")

parser.add_argument("--ext", default=".tgbg", help="Target extension for batch decryption (default: .tgbg)")

parser.add_argument("--recursive", action="store_true", help="Process subfolders recursively")

args = parser.parse_args()

if args.note:

note_recovery_id, note_machine_id, note_path = load_ids_from_note_path(args.note)

if not args.recovery_id:

args.recovery_id = note_recovery_id

if not args.machine_id:

args.machine_id = note_machine_id

print(f"[+] Parsed IDs from ransom note: {note_path}")

elif not args.recovery_id and not args.machine_id:

note_prompt = input("Ransom note path (press Enter to skip): ").strip()

if note_prompt:

note_recovery_id, note_machine_id, note_path = load_ids_from_note_path(note_prompt)

args.recovery_id = note_recovery_id

args.machine_id = note_machine_id

print(f"[+] Parsed IDs from ransom note: {note_path}")

if not args.recovery_id:

args.recovery_id = prompt_nonempty("Enter Recovery ID (GREEN-BLOOD-...): ")

if not args.machine_id:

args.machine_id = prompt_nonempty("Enter Machine ID (32 ASCII bytes): ")

if not args.input and not args.dir:

target_path = Path(prompt_nonempty("Enter target path (file or folder): "))

if target_path.is_dir():

args.dir = str(target_path)

if not args.recursive:

recursive_answer = input("Process subfolders as well? [y/N]: ").strip().lower()

args.recursive = recursive_answer in ("y", "yes")

elif target_path.is_file():

args.input = str(target_path)

if not args.output:

args.output = prompt_nonempty("Output file path: ")

else:

raise SystemExit(f"Path not found: {target_path}")

recovery_bytes = parse_recovery_id(args.recovery_id)

machine_bytes = parse_machine_id(args.machine_id)

key = xor_recover_key(recovery_bytes, machine_bytes)

print(f"[+] Recovered key (hex): {key.hex().upper()}")

if args.input:

if not args.output:

raise SystemExit("--output (-o) is required in single-file mode (-i).")

decrypt_aes_ctr_file(Path(args.input), Path(args.output), key)

print(f"[+] Decrypted: {args.output}")

return

folder = Path(args.dir)

if not folder.is_dir():

raise SystemExit(f"Folder not found: {folder}")

ok, fail = decrypt_folder(folder, key, args.ext, args.recursive)

print(f"[+] Done. success={ok}, failed={fail}")

if __name__ == "__main__":

main()