NoobCrypt targets Windows OS and its method of distribution is currently unknown. This variant was named after the text it displays if the victim enters “123” in the decryption key field. If this code is entered, NoobCrypt taunts the victim with the following pop-up message: “123 is not the code! You idiot. GO PAY IF U WANT UR PC BACK. NOOB HAH.” Each release of this variant is associated with a specific Bitcoin address and ransom amount and security researchers have used that information to determine the decryption keys. The ransom payment demand for NoobCrypt varies.
- Bleeping Computer provides more information about NoobCrypt, as well as decryption instructions, here.