Wearefriends ransomware (virus) - Tutorial
Wearefriends virus Removal Guide
What is Wearefriends ransomware?
Hacker group behind Wearefriends ransomware extorts innocent users
Wearefriends is a file locker malware that targets machines with Intel 386 CPU or later and compatibles. The virus prevents users from opening pictures, videos, music, documents, and other files. After the malicious program infiltrates the computer, files are locked using the AES algorithm.[1] The affected files are marked with a .wearefriends extension. It is usually during this period that victims notice the infection. The file names look something like this – picture.jpg.wearefriends, video.mp4.wearefriends, and the icons turn to white pages.
Shortly after file locking is done, the malware opens a pop-up window named “!!YOU ARE FU**ED!!”. In this animated window, hackers reveal to victims what happened to their files and ask for payment to receive a decryption key. Hackers use strong language to convey their short message – you have to send 0.05 of Bitcoin (which at the time of writing is about $2,300) to bc1q4v9ngtqpdq6jfvmz7f72xd7cg97cd082vnmv63 wallet address to recover your data. Victims are then supposed to send the transaction ID to clay_whoami_1@protonmail.ch email.
It is recommended not to pay the ransom because victims often do not receive anything back from ransomware developers after the payment is sent. Once you make a cryptocurrency transaction, you cannot reverse it, so you will most likely be left without your money and data. By paying the money, you will also support the malicious activity, which leads to more malware attacks on innocent users.
Ransomware attacks have been increasing rapidly since the pandemic started, most likely because more people are forced to work from home and spend more time online in general. People who do not have their data backed up anywhere else are likely to pay the amount asked if the files are essential to them. Often, there is no other way to recover the files, so people take a risk by paying the money.
NAME | Wearefriends |
TYPE | Ransomware, cryptovirus, data locking malware |
ENCRYPTION METHOD | AES via .NET |
DISTRIBUTION | Email attachments, peer-to-peer file sharing platforms, malicious ads |
FILE EXTENSION | .wearefriends |
RANSOM NOTE | !!YOU ARE FU**ED!! pop-up window |
RANSOM AMOUNT | 0.05 BTC |
FILE RECOVERY | It is almost impossible to recover the files if you do not have backups |
MALWARE REMOVAL | Scan your machine with anti-malware software SpyHunter 5Combo Cleaner to eliminate the malicious files. This will not recover your files. |
SYSTEM FIX | Windows reinstallation can be avoided with FortectIntego maintenance tool, which can fix damaged files |
In addition to file locking, the virus has been observed using an abnormal amount of CPU power, potentially having a key logger, crypto functionalities which means cryptojacking[2] is a possibility resulting in slower speeds and electricity usage increase.
How do file locking programs infect operating systems?
Cybercriminals use email attachments, fake software updates, unofficial sites that distribute “cracked” programs, and peer-to-peer file-sharing platforms[3] to spread malicious code. Wearefriends virus is delivered using a .NET executable file. Net.exe is a system file used by Microsoft Windows and appears in Windows Task Manager as a process named “Net Command.” However, some viruses or Trojans use the same file name in order to remain undetected. Opening .exe files can be the launch of a virus that brings down your computer and the entire network.
You should always be careful when downloading email attachments. Do not download attachments from senders you do not recognize, although sometimes malicious programs can infiltrate emails and send them from your friend's list. So non-regardless of who sent the email, always make sure to check it is safe to download.
Fake software updaters infect computers by installing malware instead of updates. Never update your software through your browser. If a page pops up saying you need to update something, go to the software official page or open the program itself and check. Never download anything from a pop-up or suddenly opened new tab.
It is prevalent for cracking tools to contain malware or have malicious code injected into them. As this activity is illegal, they are distributed on third-party sites that are not regulated.
Users who have been infected should disconnect from their network, as ransomware could infect other machines on the local network and remove the malicious program first. For private individuals disconnecting the ethernet cable is enough.
The full ransom note from the hacker group:
Your files (count: -) have been F***ED!
In order to recover your data…Please send 0.05 Bitcoin's to the following BTC
bc1q4v9ngtqpdq6jfvmz7f72xd7cg97cd082vnmv63Next, E-mail your transaction ID to the following
clay_whoami_1@protonmail.ch
Hackers use cryptocurrency as a method for payment because it hides their identity. Most often, criminals can only be caught if they want to turn it into fiat currency or transfer it to a bank account as that requires a person to prove their identity. One of the only ways cybercriminals can remain anonymous is by exchanging crypto for gift cards.
Threat actors also use ProtonMail[4] as their communication channel because it does not require any personal details to sign up. The emails are also encrypted to hide the IP addresses. Investigators[5] were able to identify 4 IP addresses located in the US for the servers used to generate decryption keys, but that does not give any indication of where the attackers are actually from.
Safety measures are key if you want to avoid ransomware attacks
- Have all your data backed up. Do not store it just in one place to prevent permanent data loss
- Use antivirus software to perform regular system scans. Security software also warns you about potential threats
- Keep everything updated and patched. Hackers often use vulnerabilities to infiltrate
- Use ad-blocking software to avoid clicking on malicious advertisements
- Do not use unofficial sources to download programs as they can have other software bundled together in the installation
Remove the intruder from your machine
If you try to recover your data first, it can result in permanent loss. It can also encrypt your files the second time. It will not stop until you remove the malicious files causing it first. You should not attempt removing the malicious program yourself. Use anti-malware tools like SpyHunter 5Combo Cleaner or Malwarebytes to scan your system. This security software should find all the related files and entries and remove them automatically for you. Automatic removal is the best option because there is less risk of leaving some of the traces behind.
Malware could prevent you from using antivirus software by turning it off. In that case, you should proceed with accessing Safe Mode first:
Windows 7 / Vista / XP
-
Click Start > Shutdown > Restart > OK.
-
When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
-
Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Click Restart.
- Press 5 or click 5) Enable Safe Mode with Networking.
File recovery using third-party software
Only hackers hold the decryption key, which can unlock your files, so if you did not back them up previously, you possibly lost your files forever. You can try using data recovery software, but third-party programs cannot always decrypt the files. We suggest at least trying this method. Before proceeding, you have to copy the corrupted files and place them in a USB flash drive or another storage. And remember – only do this if you have already removed Wearefriends ransomware.
- Download Data Recovery Pro.
- Double-click the installer to launch it.
- Follow on-screen instructions to install the software.
- As soon as you press Finish, you can use the app.
- Select Everything or pick individual folders where you want the files to be recovered from.
- Press Next.
- At the bottom, enable Deep scan and pick which Disks you want to be scanned.
- Press Scan and wait till it is complete.
- You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
- Press Recover to retrieve your files.
The operating system is left damaged after an attack
Performance, stability, and usability issues, to the point where a full Windows reinstall is required, are expected after malware infection. These types of infections can alter the Windows registry database, damage vital bootup and other sections, delete or corrupt DLL files, etc. Once a system file is damaged by malware, antivirus software is not able to repair it.
This is why FortectIntego was developed. It can fix a lot of the damage caused by an infection like this. Blue Screen errors, freezes, registry errors, damaged DLLs, etc., can make your computer completely unusable. By using this maintenance tool, you could avoid Windows reinstallation.
- Download the application by clicking on the link above
- Click on the ReimageRepair.exe
- If User Account Control (UAC) shows up, select Yes
- Press Install and wait till the program finishes the installation process
- The analysis of your machine will begin immediately
- Once complete, check the results – they will be listed in the Summary
- You can now click on each of the issues and fix them manually
- If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.
Getting rid of Wearefriends virus. Follow these steps
Isolate the infected computer
Some ransomware strains aim to infect not only one computer but hijack the entire network. As soon as one of the machines is infected, malware can spread via network and encrypt files everywhere else, including Network Attached Storage (NAS) devices. If your computer is connected to a network, it is important to isolate it to prevent re-infection after ransomware removal is complete.
The easiest way to disconnect a PC from everything is simply to plug out the ethernet cable. However, in the corporate environment, this might be extremely difficult to do (also would take a long time). The method below will disconnect from all the networks, including local and the internet, isolating each of the machines involved.
- Type in Control Panel in Windows search and press Enter
- Go to Network and Internet
- Click Network and Sharing Center
- On the left, pick Change adapter settings
- Right-click on your connection (for example, Ethernet), and select Disable
- Confirm with Yes.
If you are using some type of cloud storage you are connected to, you should disconnect from it immediately. It is also advisable to disconnect all the external devices, such as USB flash sticks, external HDDs, etc. Once the malware elimination process is finished, you can connect your computers to the network and internet, as explained above, but by pressing Enable instead.
Report the incident to your local authorities
Ransomware is a huge business that is highly illegal, and authorities are very involved in catching malware operators. To have increased chances of identifying the culprits, the agencies need information. Therefore, by reporting the crime, you could help with stopping the cybercriminal activities and catching the threat actors. Make sure you include all the possible details, including how did you notice the attack, when it happened, etc. Additionally, providing documents such as ransom notes, examples of encrypted files, or malware executables would also be beneficial.
Law enforcement agencies typically deal with online fraud and cybercrime, although it depends on where you live. Here is the list of local authority groups that handle incidents like ransomware attacks, sorted by country:
- USA – Internet Crime Complaint Center IC3
- United Kingdom – ActionFraud
- Canada – Canadian Anti-Fraud Centre
- Australia – ScamWatch
- New Zealand – ConsumerProtection
- Germany – Polizei
- France – Ministère de l'Intérieur
If your country is not listed above, you should contact the local police department or communications center.
Finally, you should always think about the protection of crypto-ransomwares. In order to protect your computer from Wearefriends and other ransomwares, use a reputable anti-spyware, such as FortectIntego, SpyHunter 5Combo Cleaner or Malwarebytes
How to prevent from getting ransomware
Choose a proper web browser and improve your safety with a VPN tool
Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online. One of the basic means to add a layer of security – choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features. However, if you want true anonymity, we suggest you employ a powerful Private Internet Access VPN – it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.
Lost your files? Use data recovery software
While some files located on any computer are replaceable or useless, others can be extremely valuable. Family photos, work documents, school projects – these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur: power cuts, Blue Screen of Death errors, hardware failures, crypto-malware attack, or even accidental deletion.
To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, Data Recovery Pro can be your only hope to retrieve your invaluable files.
- ^ Tarcísio Marinho. Ransomware encryption techniques. Medium. Writers' Hub.
- ^ Rob Sobers. What Is Cryptojacking? Prevention and Detection Tips. Varonis. Threat Detection.
- ^ Andrew Kalafut. A study of malware in peer-to-peer networks. ResearchGate. Scientific Papers.
- ^ Security Details. ProtonMail. Security.
- ^ Contacted IP Addresses. Virustotal. Relations.