CryptoPokemon uses SHA256 and AES-128 to capture victim's files, and adds the extension ".CRYPTOPOKEMON". The victim is then presented a ransom note and website claiming to be "PokemonGO".
The ransom note "!INFO.CRYPTOPOKEMON.log" text can be found below:
All files on your computer are encrypted. Files have the extension CRYPTOPOKEMON.
Do not try to decrypt the files yourself, this will only contribute to the loss of all your data on the computer.
To decrypt files, please transfer 0.0200000 BTC to 1Lx46kNYSXTRwMWBxhxxdW3nisJ61yfVoW
After you transfer money, write to email [email protected] , saying this word "12356749412506806744".
For advanced users:
After transferring money, go to http://cryptopokemon.top/ , and follow the instructions.
Your computer ID: 12356749412506806744
To enter the site, use the browser.
COPYRIGHT (c)2019 PokemonGO CRYPTOLOCKER pokemongo.icu