FileCoder Decryptor (require log file of malware execution process from Monitor.app)

decryptor.py

import os
import sys
import time
import re
import subprocess


root_dir = '/Users'


def get_zip_passwords_from_file(filename):
	content = str(subprocess.check_output(["cat", filename]))
	password = re.search('zip(.{1,4})-0(.{1,4})-P(.{1,4})(\\w{1,70})', content).group().split(r'\x00')[-1]
	print("The password is: ", password)
	time.sleep(10)
	return password


def decrypt(password):
	encrypted_files_present = False
	
	for subdir, dirs, files in os.walk(root_dir):
		for file in files:
			absolute_filepath = os.path.join(subdir, file)
			if absolute_filepath.endswith('.crypt'):
				encrypted_files_present = True
				try:
					subprocess.call(["unzip", "-o", "-P", password, absolute_filepath, "-d", "/"])
					subprocess.call(["rm", "-rf", absolute_filepath])
				except BaseException:
					continue
				else:
					print("Recovered: ", absolute_filepath, "successfully!")
	return encrypted_files_present


def main():
	try:
		password = get_zip_passwords_from_file(sys.argv[1])
	except BaseException:
		print("Usage: decryptor.py <Monitor.app log file>")
		sys.exit(0)
	while decrypt(password):
		decrypt(password)


if __name__ == '__main__':
	main()