Home Malware Programs Ransomware .frendi Ransomware

.frendi Ransomware

Posted: March 4, 2019

The .frendi Ransomware is a file-locking Trojan from the Dharma Ransomware update to the Crysis Ransomware's family. The .frendi Ransomware can deliver attacks that lock your files with encryption automatically, along with supporting features such as changing their names and removing their backups. Windows users should save backups on other devices for security purposes and use anti-malware solutions for removing the .frendi Ransomware properly.

The Next Name in Fear for Your Files

Locking media for money is getting a new instigator in the form of a recent build from the Crysis Ransomware's Ransomware-as-a-Service generator. Like nearly all of the modern versions of the family, this version, the .frendi Ransomware bases itself off of the secured Dharma Ransomware edition that isn't susceptible to old decryption solutions. Some members of the cyber-security community speculate of additional changes that may make the .frendi Ransomware a relative of the Phobos Ransomware, a well-known Globe Ransomware copycat, although malware analysts have yet to confirm such an update.

Whether that last estimate is factual or not, the .frendi Ransomware continues leveraging AES-based encryption attacks that help it lock hundreds or even thousands of documents, images, and other media on the Windows systems automatically. The .frendi Ransomware also replaces the filename with an ID serial, the threat actor's e-mail, and a 'Frendi' extension, hence its name. The use of an AOL account for the e-mail contact is an unprofessional element in this campaign, and malware experts usually note it as the mark of a mostly-inexperienced threat actor.

The victims can find two different ransom notes, either on the desktop or in folders with encrypted files. One of these documents uses a Notepad TXT format, and the other, an advanced HTML (or HTA) pop-up. Following the payment instructions is a risk that may not pay off for users trying to buy a decryptor, but there is no public decryption alternative for restoring any files. However, malware experts see no reason for discouraging the use of the 'free samples' that the threat actors of the .frendi Ransomware's family traditionally provide.

Stopping a Ransomware Business Just as It Opens

Ransomware-as-a-Service lends its services out to other threat actors relatively indiscriminately, as long as they pay an opening fee or surrender a percentage of the ransom. This business model can lend itself to many distribution modes, but malware researchers find attacks from RaaS threats focusing on either spam e-mails or brute-force attacks, overall. Securing your login credentials with unique, complex passwords, and maintaining care around any e-mail-sent attachments or links will keep your PC safe from the bulk of attacks.

The encryption in use by the .frendi Ransomware's family blocks the file's data with an AES algorithm before securing the key with a customized RSA one. Since there isn't a free decryption service that could unlock such an attack, without information that's in the threat actors' ownership, the users always should back up their work as a failsafe. For infection prevention or disinfection, most anti-malware products can delete the .frendi Ransomware and other members of its family, from the modern Heets Ransomware and the KARLS Ransomware to the Bizer Ransomware or the Cobra Ransomware, without issues.

The .frendi Ransomware is one finger of a beast with many hands, all of which grasp your digital media as an intermediary for making money. Ransomware-as-a-Service is too large an industry to counteract without the users doing their part to stop attacks with all due care.

Use SpyHunter to Detect and Remove PC Threats

If you are concerned that malware or PC threats similar to .frendi Ransomware may have infected your computer, we recommend you start an in-depth system scan with SpyHunter. SpyHunter is an advanced malware protection and remediation application that offers subscribers a comprehensive method for protecting PCs from malware, in addition to providing one-on-one technical support service.

Download SpyHunter's Malware Scanner

Note: SpyHunter's free version is only for malware detection. If SpyHunter detects malware on your PC, you will need to purchase SpyHunter's malware tool to remove the malware threats. Learn more on SpyHunter. If you would like to uninstall SpyHunter for any reason, please follow these uninstall instructions. To learn more about our policies and practices, visit our EULA, Privacy Policy and Threat Assessment Criteria .

Why can't I open any program including SpyHunter? You may have a malware file running in memory that kills any programs that you try to launch on your PC. Tip: Download SpyHunter from a clean computer, copy it to a USB thumb drive, DVD or CD, then install it on the infected PC and run SpyHunter's malware scanner.