How to remove FriedEx ransomware

FriedEx virus attacks organizations and takes their files to hostage

FriedEx ransomware, also known as Bitpaymer virus, is a file-encrypting extortionist that uses a strong encryption algorithm and appends .locked file extension to targeted data. Following the successful encryption, malware drops .readme_txt file with data recovery instructions were victims are asked to pay 50 Bitcoins to get back corrupted files.

According to the latest research data, FriedEx is developed by the same cyber criminals who created an infamous Dridex banking trojan.^[1] However, ransomware was started spreading in July 2017, but its attacks continue causing problems in 2018 as well.

The FriedEx virus uses complex cryptography. In order to make files inaccessible, the malware uses RC4 and 1024-bit RSA encryption algorithms. Soon as it finishes corrupting important data, it also creates a ransom note for each file with .locked extension. Hence, it makes a total mess on the system just to make sure that victim receives a data recovery offer.

The ransom note reveals that malware targets organizations instead of individual computer users. This makes the virus even more dangerous:

YOUR COMPANY HAS BEEN SUCCESSFULLY PENETRATED!
DO NOT RESET OR SHUTDOWN – files may be damaged. DO NOT TOUCH this file.
All files are encrypted, we accept only bitcoins to share the decryption software for your network.
Also, we have gathered all your “private sensitive data.” So if you decide not to pay anytime soon, we would share it with media's.
It may harm your business reputation and the company's capitalization fell sharply.
Do not try to do it with 3rd-parties programs, files might be damaged then.
Decrypting of your files is only possible with the special decryption software.
To receive your private key and the decryption software please follow the link (using tor2web service):
h[tt]ps://qmnmrba4s4a3py6z.onion[.]to/order/***
If this address is not available, follow these steps:
1. Download and install Tor Browser: h[tt]ps://www.torproject[.]org/projects/torbrowser.html.en
2. After a successful installation, run the browser and wait for initialization.
3. Type in the address bar: h[tt]ps://gmnmrba4s4a3py6z[.]onion/order/***
4. Follow the instructions on the site
5. This link is valid for 72 hours only. Afetr that period your local data would be lost completely.
6. Any questions: 15010050@tutamail.com
KEY:[RANDOM CHARACTERS]

However, victims of ransomware are not advised to pay the ransom. Security experts recommend eliminating the virus and recovering from backups. For safe and successful FriedEx removal we suggest using FortectIntego which is a reputable and effective malware removal tool.

Any attempts to remove FriedEx manually might lead to irreparable damage to the system. Ransomware is a complicated and harmful cyber threat that might inject malicious code into legit system processes, so cleaning the system requires professional software to avoid the damage.

Hospitals are the main targets of the FriedEx malware

FriedEx or BitPaymer started its malicious task in August 2017 by launching attacks in the UK.^[2] Malware hit three hospitals in National Health Service’s (NHS) Lanarkshire outpost:

• Hairmyres Hospital in East Kilbride;
• Monklands Hospital in Airdrie;
• Wishaw General Hospital.

Malware encrypted files on the targeted computers and asked to pay 50 Bitcoins to get them back. However, cyber criminals also tried to blackmail victims. According to the received ransom note, hackers managed to steal “private sensitive data” which will be leaked unless the ransom is paid.

According to the representatives, FriedEx was delivered in the phishing email.^[3] Hence, only one click disturbed whole hospital’s work. Nevertheless, emergency procedures were continued; many appointments were canceled.

Criminals use several methods to infiltrate machines

As the example of attacks in Scotland’s hospitals tells, one of the ways how malware enters the system is phishing. The malicious program sneaks into the system as soon as a user opens a malicious email attachment. Hence, users are advised to remain vigilant and do not rush opening documents or files sent via email.

Security researchers also detected that malware could launch brute force attacks via Microsoft Remote Desktop Protocol (RDP).^[4] Thus, it’s important to secure RDP to minimize the risk of the ransomware infiltration.

Additionally, users are advised to follow general security tips when browsing the web:

avoid clicking unknown links or files received in email, social networks or communication apps,
do not download illegal or cracked software,
do not install software updates from pop-ups,
create data backups,
protect computers with reputable antivirus,
install all available system and software updates.

Instructions on how to get rid of FriedEx ransomware virus

The only safe way to remove FriedEx from the machine is to use professional software. Malware removal tools like FortectIntego or MalwarebytesMalwarebytes can detect and eliminate this cyber threat without any problems. However, you may need to take additional steps.

To make FriedEx removal smooth, you should reboot the affected device to Safe Mode with Networking. This allows disabling malware and preventing it from blocking security software. The detailed explanation is given below.