Emsisoft released a free decryptor for CryptoPokemon ransomware

Good news for the victims of the CryptoPokemon ransomware, security experts at Emsisoft just released a free decrypter tool.

Victims of the CryptoPokemon ransomware have a good reason to smile, security experts at Emsisoft have released a free decrypter tool.

The ransomware was first discovered by experts at IntezerLabs, the CryptoPokemon ransomware is a new strain of ransomware that encrypts files and demands a payment of a 0.02 Bitcoin ransom to decrypt them.

Researchers at Emsisoft discovered a vulnerability in the ransomware and exploited it to decrypt victims’ files.

“After CryptoPokemon was brought to our attention, Emsisoft security experts were able to find a flaw in the ransomware’s code and create a decrypter that allows you to decrypt your files without paying a cent.” reads the blog post published by Emsisoft.

The CryptoPokemon ransomware encrypts files using SHA256 + AES128. The malicious code drops a ransom note of the infected system that contains the wallet address of the attacker where to transfer the funds, an email address and a website where that could be used to the attackers for any problem.

Below the ransom note left by attackers on the infected websites:

All files on your computer are encrypted. Files have the extension CRYPTOPOKEMON.

Do not try to decrypt the files yourself, this will only contribute to the loss of all your data on the computer.

To decrypt files, please transfer 0.0200000 BTC to 1Lx46kNYSXTRwMWBxhxxdW3nisJ61yfVoW

After you transfer money, write to email qaq94t64c45d3scd@openmailbox.org , saying this word “12356749412506806744”.

For advanced users:

After transferring money, go to http://cryptopokemon.top/ , and follow the instructions.

Your computer ID: 12356749412506806744

To enter the site, use the browser.

COPYRIGHT (c)2019 PokemonGO CRYPTOLOCKER pokemongo.icu

Users can download the free CryptoPokemon decrypter from the following address:

https://decrypter.emsisoft.com/cryptopokemon

Below the step by step procedure:

IMPORTANT! Make sure you remove the malware from your system first, otherwise it will repeatedly lock your system or encrypt files.
Download the free Emsisoft CryptoPokemon decrypter.
Run the executable and confirm the license agreement when asked.
Click “Start” to decrypt your files. Note that this may take a while.
All done! Gotta crypt ’em all!

EMSISOFT recently also released free decryptors for the Planetary Ransomware, the Hacked Ransomware, and the PewDiePie ransomware.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – CryptoPokemon ransomare, decryptor)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.