Wearefriends ransomware (virus) - Tutorial

What is Wearefriends ransomware?

Hacker group behind Wearefriends ransomware extorts innocent users

Wearefriends infects the operating system and locks users' files

Wearefriends is a file locker malware that targets machines with Intel 386 CPU or later and compatibles. The virus prevents users from opening pictures, videos, music, documents, and other files. After the malicious program infiltrates the computer, files are locked using the AES algorithm.^[1] The affected files are marked with a .wearefriends extension. It is usually during this period that victims notice the infection. The file names look something like this – picture.jpg.wearefriends, video.mp4.wearefriends, and the icons turn to white pages.

Shortly after file locking is done, the malware opens a pop-up window named “!!YOU ARE FU**ED!!”. In this animated window, hackers reveal to victims what happened to their files and ask for payment to receive a decryption key. Hackers use strong language to convey their short message – you have to send 0.05 of Bitcoin (which at the time of writing is about $2,300) to bc1q4v9ngtqpdq6jfvmz7f72xd7cg97cd082vnmv63 wallet address to recover your data. Victims are then supposed to send the transaction ID to clay_whoami_1@protonmail.ch email.

It is recommended not to pay the ransom because victims often do not receive anything back from ransomware developers after the payment is sent. Once you make a cryptocurrency transaction, you cannot reverse it, so you will most likely be left without your money and data. By paying the money, you will also support the malicious activity, which leads to more malware attacks on innocent users.

Ransomware attacks have been increasing rapidly since the pandemic started, most likely because more people are forced to work from home and spend more time online in general. People who do not have their data backed up anywhere else are likely to pay the amount asked if the files are essential to them. Often, there is no other way to recover the files, so people take a risk by paying the money.

In addition to file locking, the virus has been observed using an abnormal amount of CPU power, potentially having a key logger, crypto functionalities which means cryptojacking^[2] is a possibility resulting in slower speeds and electricity usage increase.

Wearefriends was noticed using a lot of CPU power, so users could experience a decrease in performance

How do file locking programs infect operating systems?

Cybercriminals use email attachments, fake software updates, unofficial sites that distribute “cracked” programs, and peer-to-peer file-sharing platforms^[3] to spread malicious code. Wearefriends virus is delivered using a .NET executable file. Net.exe is a system file used by Microsoft Windows and appears in Windows Task Manager as a process named “Net Command.” However, some viruses or Trojans use the same file name in order to remain undetected. Opening .exe files can be the launch of a virus that brings down your computer and the entire network.

You should always be careful when downloading email attachments. Do not download attachments from senders you do not recognize, although sometimes malicious programs can infiltrate emails and send them from your friend's list. So non-regardless of who sent the email, always make sure to check it is safe to download.

Fake software updaters infect computers by installing malware instead of updates. Never update your software through your browser. If a page pops up saying you need to update something, go to the software official page or open the program itself and check. Never download anything from a pop-up or suddenly opened new tab.

It is prevalent for cracking tools to contain malware or have malicious code injected into them. As this activity is illegal, they are distributed on third-party sites that are not regulated.

Users who have been infected should disconnect from their network, as ransomware could infect other machines on the local network and remove the malicious program first. For private individuals disconnecting the ethernet cable is enough.

The malicious program is created for the purpose of making money

The full ransom note from the hacker group:

Your files (count: -) have been F***ED!
In order to recover your data…

Please send 0.05 Bitcoin's to the following BTC
bc1q4v9ngtqpdq6jfvmz7f72xd7cg97cd082vnmv63

Next, E-mail your transaction ID to the following
clay_whoami_1@protonmail.ch

Hackers use cryptocurrency as a method for payment because it hides their identity. Most often, criminals can only be caught if they want to turn it into fiat currency or transfer it to a bank account as that requires a person to prove their identity. One of the only ways cybercriminals can remain anonymous is by exchanging crypto for gift cards.

Threat actors also use ProtonMail^[4] as their communication channel because it does not require any personal details to sign up. The emails are also encrypted to hide the IP addresses. Investigators^[5] were able to identify 4 IP addresses located in the US for the servers used to generate decryption keys, but that does not give any indication of where the attackers are actually from.

.wearefriends extension is appended to files after encryption is done

Safety measures are key if you want to avoid ransomware attacks

• Have all your data backed up. Do not store it just in one place to prevent permanent data loss
• Use antivirus software to perform regular system scans. Security software also warns you about potential threats
• Keep everything updated and patched. Hackers often use vulnerabilities to infiltrate
• Use ad-blocking software to avoid clicking on malicious advertisements
• Do not use unofficial sources to download programs as they can have other software bundled together in the installation

Remove the intruder from your machine

If you try to recover your data first, it can result in permanent loss. It can also encrypt your files the second time. It will not stop until you remove the malicious files causing it first. You should not attempt removing the malicious program yourself. Use anti-malware tools like SpyHunter 5Combo Cleaner or Malwarebytes to scan your system. This security software should find all the related files and entries and remove them automatically for you. Automatic removal is the best option because there is less risk of leaving some of the traces behind.

Malware could prevent you from using antivirus software by turning it off. In that case, you should proceed with accessing Safe Mode first:

Windows 7 / Vista / XP

1. Click Start > Shutdown > Restart > OK.

2. When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.

3. Select Safe Mode with Networking from the list.

Windows 10 / Windows 8

1. Right-click on Start button and select Settings.
   
2. Scroll down to pick Update & Security.
3. On the left side of the window, pick Recovery.
4. Now scroll down to find Advanced Startup section.
5. Click Restart now.
6. Select Troubleshoot.
7. Go to Advanced options.
8. Select Startup Settings.
9. Click Restart.
10. Press 5 or click 5) Enable Safe Mode with Networking.

File recovery using third-party software

Only hackers hold the decryption key, which can unlock your files, so if you did not back them up previously, you possibly lost your files forever. You can try using data recovery software, but third-party programs cannot always decrypt the files. We suggest at least trying this method. Before proceeding, you have to copy the corrupted files and place them in a USB flash drive or another storage. And remember – only do this if you have already removed Wearefriends ransomware.

1. Download Data Recovery Pro.
2. Double-click the installer to launch it.
   
3. Follow on-screen instructions to install the software.
4. As soon as you press Finish, you can use the app.
5. Select Everything or pick individual folders where you want the files to be recovered from.
6. Press Next.
7. At the bottom, enable Deep scan and pick which Disks you want to be scanned.
8. Press Scan and wait till it is complete.
9. You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
10. Press Recover to retrieve your files.

The operating system is left damaged after an attack

Performance, stability, and usability issues, to the point where a full Windows reinstall is required, are expected after malware infection. These types of infections can alter the Windows registry database, damage vital bootup and other sections, delete or corrupt DLL files, etc. Once a system file is damaged by malware, antivirus software is not able to repair it.

This is why FortectIntego was developed. It can fix a lot of the damage caused by an infection like this. Blue Screen errors, freezes, registry errors, damaged DLLs, etc., can make your computer completely unusable. By using this maintenance tool, you could avoid Windows reinstallation.

• Download the application by clicking on the link above
• Click on the ReimageRepair.exe
  
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.