Victims of the CryptoPokemon
The ransomware was first discovered by experts at IntezerLabs, the CryptoPokemon ransomware is a new strain of ransomware that encrypts files and demands a payment of a 0.02 Bitcoin ransom to decrypt them.
Researchers at Emsisoft
“After CryptoPokemon was brought to our attention, Emsisoft security experts were able to find a flaw in the ransomware’s code and create a decrypter that allows you to decrypt your files without paying a cent.” reads the blog post published by Emsisoft.
The CryptoPokemon ransomware encrypts files using SHA256 + AES128. The malicious code drops a ransom note of the infected system that contains the wallet address of the attacker where to transfer the funds, an email address and a website where that could be used to the attackers for any problem.
Below the ransom note left by attackers on the infected websites:
All files on your computer are encrypted. Files have the extension CRYPTOPOKEMON.
Do not try to decrypt the files yourself, this will only contribute to the loss of all your data on the computer.
To decrypt files, please transfer 0.0200000 BTC to 1Lx46kNYSXTRwMWBxhxxdW3nisJ61yfVoW
After you transfer money, write to email firstname.lastname@example.org , saying this word “12356749412506806744”.
For advanced users:
After transferring money, go to http://cryptopokemon.top/ , and follow the instructions.
Your computer ID: 12356749412506806744
To enter the site, use the browser.
COPYRIGHT (c)2019 PokemonGO CRYPTOLOCKER pokemongo.icu
Users can download the free CryptoPokemon
Below the step by step procedure: