Nullbyte ransomware, fake NecroBot for PokemonGO

About Nullbyte Ransomware

The Nullbyte Ransomware virus is more advanced versions of DetoxCrypto Ransomware that uses the population of already World Wide known game – PokemonGO. After a while many hackers have written a lot of bots and hacks for this game, one of the most popular among them is NecroBot. Nullbyte Ransomware is disguising itself as this program to get inside of a system. This is the reason why this ransomware virus can be very dangerous for lots of people.

Nullbyte Ransomware

This ransomware is spreading as a Github project and poses itself as a rebuild version of a NecroBot application. By doing that, cybercriminals are trying to fool users into the download of this fake bot.

If a user decides to download and run this program, it will show him the usual interface of NecroBot. Programs need login and password to run further. Once user enters these credentials (legit or fake), Nullbyte Ransomware will show that it`s trying to connect to NecroBot servers. But on the background, this ransomware virus already encrypts files on your computer and when it`s over, it will show you the demanded ransom fee 0.1 btc.

Encryption process

The Nullbyte ransomware adds _nullbyte extension to the files and uses AES encryption. here is the list of location that this ransomware virus will encrypt:

%USERPROFILE%\Downloads
%USERPROFILE%\Desktop
%USERPROFILE%\Documents
%USERPROFILE%\Favorites
%USERPROFILE%\Music
%USERPROFILE%\Videos
%USERPROFILE%\Pictures
%USERPROFILE%\Contacts

There is one more thing this virus does. When it`s running, it will close all active processes of Chrome, Firefox, iexplore, and Opera. Also, it terminates processes taskmgr and cmd. Because of this, it will be much more difficult to make any kind of analysis.

How to prevent Nullbyte ransomware infection:

The best way to protect your computer from infection is to avoid this infection at any cost. We are glad to announce that our anti-ransomware product is now ready for a beta release! GridinSoft Anti-Ransomware beta was developed to protect your computer from cyptoviruses. Try this program, it may save your computer from possible future infection. Help us make GridinSoft Anti-Ransomware better by leaving your feedback! To install this program follow next steps:

Download GridinSoft Anti-Ransomware

Leave a Comment


*