LockBit 3.0 (Black) Ransomware — Reverse Engineering, Config Extraction, Decryptor PoC

rule LockBit_3_0_Black_Generic {
    meta:
        author = "FZ-Control"
        family = "LockBit"
        version = "3.0 Black"
        date = "2024-11-15"
        confidence = "high"
    strings:
        $mz = { 4D 5A }
        $rsa_import = "RSA_public_encrypt" ascii
        $onion = /lockbit[0-9a-z]{20,}\.onion/ ascii wide
        $ext = ".LOCKBIT" ascii wide
        $mutex = "Global\\LockBit" ascii wide
        $config_marker = { 00 00 00 00 ?? ?? ?? ?? 7B 22 } // JSON start after length
        $anti_vm = "VMware" ascii
        $anti_debug = "IsDebuggerPresent" ascii
    condition:
        $mz at 0 and
        (all of ($rsa_import, $onion, $ext) or
         4 of ($mutex, $config_marker, $anti_vm, $anti_debug))
}

# LockBit 3.0 Decryptor PoC (requires RSA private key)
from Crypto.Cipher import AES, PKCS1_OAEP
from Crypto.PublicKey import RSA
from Crypto.Hash import SHA256
import os, struct

def decrypt_file(enc_path, out_path, priv_key_pem):
    with open(enc_path, 'rb') as f:
        data = f.read()
    
    # Footer: last 256 bytes = RSA-encrypted AES key
    enc_aes_key = data[-256:]
    file_data = data[:-256]
    
    # Decrypt AES key
    rsa_key = RSA.import_key(priv_key_pem)
    cipher_rsa = PKCS1_OAEP.new(rsa_key, hashAlgo=SHA256)
    aes_key = cipher_rsa.decrypt(enc_aes_key)
    
    # First 16 bytes = IV, rest = ciphertext
    iv = file_data[:16]
    ct = file_data[16:]
    
    cipher_aes = AES.new(aes_key, AES.MODE_CBC, iv)
    pt = cipher_aes.decrypt(ct)
    
    # Remove PKCS7 padding
    pad_len = pt[-1]
    pt = pt[:-pad_len]
    
    with open(out_path, 'wb') as f:
        f.write(pt)
    
    # Restore timestamps
    st = os.stat(enc_path)
    os.utime(out_path, (st.st_atime, st.st_mtime))
    print(f'Decrypted: {enc_path} -> {out_path}')