Pokemon GO Ransomware
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Ranking: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Ranking: | 16,935 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 6,807 |
| First Seen: | August 15, 2016 |
| Last Seen: | July 25, 2023 |
| OS(es) Affected: | Windows |
The Pokemon GO Ransomware is a threat infection that takes over a computer and installs a backdoor. A backdoor is a simply term for access into the affected computer. Using a backdoor, third parties can have access to a computer automatically. To carry out its attack, the Pokemon GO Ransomware leverages the enormous success of the Niantic's mobile game, the Pokemon GO. The Pokemon GO Ransomware carries out two types of attacks, a basic encryption ransomware attack, which encrypts the victims' files to demand a ransom, and the creation of a backdoor to provide access to infected computers.
Table of Contents
The Pokemon GO Ransomware is not Different from Other Ransomware Trojans
The Pokemon GO Ransomware was discovered recently in August of 2016, just a month after the Pokemon GO was officially released. It seems that the versions of the Pokemon GO Ransomware appearing in the wild are still in development, meaning that it is possible that the con artists are preparing for a worldwide distribution campaign involving full versions of their threat. The Pokemon GO Ransomware is delivered in a corrupted executable file named 'PokemonGo.exe' which uses an icon of the recognizable Pokemon Pikachu. When computer users click on the Pokemon GO Ransomware's executable file, it begins encrypting the victim's files. The Pokemon GO Ransomware is based on Hidden Tear, an open source encryption ransomware Trojan released in 2016. Like Hidden Tear, the Pokemon GO Ransomware contains an encryption backdoor.
After the Pokemon GO Ransomware finishes encrypting its victims' files, the Pokemon GO Ransomware creates and hides a Windows admin account named 'Hack3r' which allows fraudsters to access the infected computer. The Pokemon GO Ransomware copies itself to all drives detected on the victim's computer and changes the affected computer's settings to ensure that the Pokemon GO Ransomware runs automatically whenever Windows starts up. The Pokemon GO Ransomware is designed to operate in the background, copying itself to any removable drives or network drives connected to the infected computer.
This Version of the Pokemon GO Ransomware may be Under Development
It is very likely that the Pokemon GO Ransomware is in its testing phase. One of the main reasons why researchers believe this, is that the Pokemon GO Ransomware is using a static encryption key currently, '123vivalalgerie.' The Pokemon GO Ransomware also attempts to connect to a private IP address, which would only be accessible from a routed network rather than from the Internet. As of now, the Pokemon GO Ransomware's ransom note and lock screen are written in Arabic. Combining this knowledge with the static encryption key, which mentions Algeria and is in French, it is possible to conclude that the people responsible for the Pokemon GO Ransomware are from, or related to, this part of the world.
Dealing Now and in the Future with the Pokemon GO Ransomware
If the full version of the Pokemon GO Ransomware is released, including the Pokemon GO and Pikachu in their content, it is possible to identify it as the Pokemon GO Ransomware through the ransom note. The Pokemon GO Ransomware has been linked to the email address 'blackhat20152015@gmail.com.' One fortunate characteristic of the Pokemon GO Ransomware is that it is based on Hidden Tear. Currently, there is a decryption utility available for victims of Hidden Tear, which should, in theory, help computer users to recover from a Pokemon GO Ransomware infection.
Con artists may take advantage of the popularity of new games, news stories, or world events to distribute threats. The Pokemon GO has been a worldwide phenomenon, and it is not surprising that the con artists are starting to take advantage of this by offering fake versions of the game, bogus guides news and cheating applications. Security analysts advise computer users to exercise caution when dealing with these programs since they may be used to distribute threats such as the Pokemon GO Ransomware.
