How to remove DriedSister ransomware

DriedSister – Japanese ransomware that doesn’t demand a ransom

DriedSister is a crypto-ransomware^[1] that has been detected at the beginning of February 2018. Ransomware researchers revealed a close relationship between this ransomware and Himouto Umaru-chan, which is why it is also dubbed as Umaru ransomware. The virus uses AES cryptography to lock MS Office documents, OpenOffice, PDF, text files, databases, photos, music, video, image files, archives, and other file types. In particular, it targets personal files that start with “-recover” argument. All files encrypted by DriedSister virus get a .干物妹！file extension, so initially named file document1.doc would look like document1.doc.干物妹！after the encryption.

The original name of the DriedSister ransomware virus is下 物 妹, which in English sounds like “Irisimo imoto.” Intersting fact about the name of the virus is that the phrase 下 物 妹 refers to a woman who has given up on love and is kind of self-indulgent. In case of this ransomware, 女woman has been replaced with 妹sister.

DriedSister ransomware does not drop a ransom note. It does not demand a ransom at all, which is why it’s not a regular crypto-ransomware so far. Although it does generate a supposed-to-be ransom note with a title in Japanese干 物 妹! 身 代金 ウ イ ル ル:, the file does not contain valuable information about DriedSister decryptor.

Initially, the virus is oriented towards Japanese users, but that does not ensure that its prevalence won’t expand worldwide. At the moment of writing, it’s not clear how many people fallen victims to this ransomware. However, it’s clear that the virus is not decryptable. The key is hard-coded, but since victims do not seek for a ransom, they did not develop a paid decryptor, at least not yet. The only way to continue using the PC is to remove DriedSister virus completely. The only way to do that is to run a thorough system scan with FortectIntego, SpyHunterCombo Cleaner, MalwarebytesMalwarebytes or another professional anti-virus. After that, there’s a handful of methods that can help to decrypt files encrypted by DriedSister ransomware. You can find all of them down below this article.

By the way, VirusTotal analysis^[2] revealed that the only 35 AV engines out of 67 are capable of recognizing this ransomware. Therefore, make sure to select a professional anti-virus tool to remove DriedSister virus.

Spam email remains the primary technique used for ransomware distribution

There are many different strategies that hackers use for ransomware distribution. These are the most popular methods currently used:

• Peer to peer (P2P) network sharing;
• Free software downloads;
• Spam e-mails;
• Fake software updates;
• Intrusive ads;
• Malicious Websites.

Apart from the multiplicity of dissemination methods, the spam email^[3] remains the most way that transmits the bulk of ransomware virus. People get professionally-looking emails, which may be generated by various authorities. Such email contains PDF, .doc, .txt, and similar attachments, which may be indicated as the check, bill, certificate or what not.
If the user opens the attachment, ransomware is being executed, and all personal files are encrypted in no time. In this case, the ransomware activates the ransomware.exe file.

As pointed out by security specialists from faravirus.ro,^[4] to protect the system from ransomware attacks, it‘s important to be careful with P2P networks and free download websites. They may also be used for distribution of malware. Besides, be careful with fake software updates claiming that your system is at risk and that the update is crucial to prevent data loss or information leakage. Such updates may also execute malicious code, so be careful and bypass all suspicious pop-up ads.

Finally, do not open emails that seem suspicious to you. If the sender does not know or you find some type/grammar mistakes, stay away from the attachment. Report such email message as spam and delete it immediately.

Get rid of DriedSister malware

DriedSister removal is hardly possible without professional malware removal software. Crypto-ransomware viruses install multiple files all over system’s folders, so detecting and removing them manually is not possible. Therefore, to remove DriedSister ransomware virus, we would recommend using FortectIntego.

If malware blocks any security program you want to enable, which is why you can’t eliminate DriedSister virus, you should follow the steps given below: