Emsisoft released a free decryptor for CryptoPokemon ransomware

Good news for the victims of the CryptoPokemon ransomware, security experts at Emsisoft just released a free decrypter tool.

Victims of the CryptoPokemon ransomware have a good reason to smile, security experts at Emsisoft have released a free decrypter tool.

The ransomware was first discovered by experts at IntezerLabs, the CryptoPokemon ransomware is a new strain of ransomware that encrypts files and demands a payment of a 0.02 Bitcoin ransom to decrypt them.

Researchers at Emsisoft discovered a vulnerability in the ransomware and exploited it to decrypt victims’ files.

“After CryptoPokemon was brought to our attention, Emsisoft security experts were able to find a flaw in the ransomware’s code and create a decrypter that allows you to decrypt your files without paying a cent.” reads the blog post published by Emsisoft.

The CryptoPokemon ransomware encrypts files using SHA256 + AES128. The malicious code drops a ransom note of the infected system that contains the wallet address of the attacker where to transfer the funds, an email address and a website where that could be used to the attackers for any problem.

Below the ransom note left by attackers on the infected websites:

All files on your computer are encrypted. Files have the extension CRYPTOPOKEMON.

Do not try to decrypt the files yourself, this will only contribute to the loss of all your data on the computer.

To decrypt files, please transfer 0.0200000 BTC to 1Lx46kNYSXTRwMWBxhxxdW3nisJ61yfVoW

After you transfer money, write to email qaq94t64c45d3scd@openmailbox.org , saying this word “12356749412506806744”.

For advanced users:

After transferring money, go to http://cryptopokemon.top/ , and follow the instructions.

Your computer ID: 12356749412506806744

To enter the site, use the browser.

COPYRIGHT (c)2019 PokemonGO CRYPTOLOCKER pokemongo.icu

Users can download the free CryptoPokemon decrypter from the following address:

https://decrypter.emsisoft.com/cryptopokemon

Below the step by step procedure:

1. IMPORTANT! Make sure you remove the malware from your system first, otherwise it will repeatedly lock your system or encrypt files.
2. Download the free Emsisoft CryptoPokemon decrypter.
3. Run the executable and confirm the license agreement when asked.
4. Click “Start” to decrypt your files. Note that this may take a while.
5. All done! Gotta crypt ’em all!

EMSISOFT recently also released free decryptors for the Planetary Ransomware, the Hacked Ransomware, and the PewDiePie ransomware.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – CryptoPokemon ransomare, decryptor)

[adrotate banner=”5″]

[adrotate banner=”13″]