Nullbyte Ransomware Removal Guide

Do you know what Nullbyte Ransomware is?

Nullbyte Ransomware is a Trojan-type infection that is set to enter your computer using dishonest methods and encrypt all of your personal files. Once it has encrypted your files, it will ask you to pay a small ransom to get the decryption key. However, you should not comply with its demands and remove it instead. Our researchers say that this ransomware might have a free decryption tool by now, so we suggest looking for one online. In this article, we are going to discuss this application’s distribution, functionality, and deletion methods.

Let us begin our analysis with Nullbyte Ransomware’s dissemination. Security experts have found that this particular application is currently being disseminated using two methods which is unusual since malware like it is usually distributed using one method only. As you would expect, its main executable is zipped and attached to a fake email. We do not know how this ransowmare’s creators present the fake emails, but it is apparent that their texts compel the would-be victims to open the zipped file. Researchers say that it might be a self-extracting file that drops the executable on your PC automatically. Interestingly, the other method used to distribute this ransomware is a program called Necrobot which is a cheating program for PokémonGO. Researchers say that the version of Necrobot featured on freeware websites can also contain Nullbyte Ransomware.

Our researchers say that if you get this ransomware via malicious emails, then you should check folders such as %userprofile%\downloads and %userprofile%\desktop, but if you get it via Necrobot, then the most likely place where this ransomware’s main executable can be placed is %TEMP%. Once on your computer, the randomly named executable will scan your PC for files to encrypt and begin the encryption process. It uses the AES encryption algorithm with either 128 or 256-bit key size. While encrypting, it is set to append the file names with the _nullbyte file extension.Nullbyte Ransomware Removal GuideNullbyte Ransomware screenshot
Scroll down for full removal instructions

Once the encryption is complete, Nullbyte Ransomware will run its Graphical User Interface (GUI) that features the ransom note and all other information you may need to pay the ransom. The criminals want you to pay the ransom in Bitcoins and they do not ask for much money. At the time of testing this particular infection, our researchers found that it asks you to pay 0.1 BTC ($57.6 USD.) The GUI features the Bitcoin wallet address that you can enter manually or use your smartphone to scan the QR code using a dedicated phone app. However, we do not recommend paying the ransom, because you might not get the promised decryption key and, we have heard that a free decryption tool may be on the way.

Now, you may run into trouble with this application if you try to close it. Once its GUI window is set to be on top of the desktop at all times, but you can drag it to the side of the screen because it is not in full-screen mode. Still, this application is set to block Task Manager and CMD.exe from running. Nevertheless, you can still install an antimalware application to scan your PC and wipe out all traces of this malicious application.

In conclusion, Nullbyte Ransomware is a highly malicious program that can render your files inaccessible by encrypting them with a strong encryption algorithm. Its creators do not demand that you pay a hefty ransom, but you should still refrain from paying it because there is no guarantee that you will get the decryption key. Therefore, we suggest that you remove it using our guide or an antimalware tool such as SpyHunter. Also, you should look for a free decryption tool to decrypt your files or restore them from backup drives.

How to delete this ransomware

  1. Press Windows+E keys.
  2. Enter the following locations in the address box.
    • %TEMP%
    • %userprofile%\downloads
    • %userprofile%\desktop
  3. Identify the malicious executable.
  4. If found, right-click it and click Delete.
  5. Empty the Recycle Bin.

In non-techie terms:

Nullbyte Ransomware is an application whose sole purpose is to encrypt your personal files and then offer you to purchase the decryption key to decrypt them. You can risk purchasing this key, but there are no guarantees. Therefore, we recommend that you remove this malicious application from your computer as soon as possible.