SYSDF Ransomware: Analysis, .SYSDF File Recovery, and Removal Guide

SYSDF is a ransomware program belonging to the Dharma malware family. Typically targeting small businesses, it encrypts files and demands ransom payments for decryption. The ransomware was first identified by Jakub Kroustek on February 16, 2024.

WHAT IS SYSDF RANSOMWARE?

SYSDF ransomware is another variant of the Dharma ransomware family, which has been active since 2016. Initially identified on February 16, it adds a unique “.SYSDF” extension to encrypted files, along with a complex mask containing attack details such as victim ID and contact email for the hackers. After encryption, affected files exhibit the following pattern:

Image1.png → Image1.png.id-C3B22A85.[Dec24hepl@aol.com].SYSDF

Upon finishing the encryption, malware creates its specific read.txt files in each folder that includes encrypted files, and also on the desktop. Additionally, malware spawns and opens a file named info.hta, so it acts as notification for a victim. Below, you can see the messages from both ransom notes.

Text in the read.txt ransom note:

all your data has been locked us


You want to return?


write email Dec24hepl@aol.com

HOW TO RECOVER .SYSDF FILES?

Regrettably, there are currently no viable options for decrypting files affected by Dharma ransomware. Many online file recovery services offered by purported “certified hackers” merely facilitate negotiations with cybercriminals. Paying these criminals is ill-advised, as it incentivizes further attacks. While losing files is undoubtedly unpleasant, statistics indicate that there are numerous avenues available for file recovery.

Explore options such as searching for backups or file duplicates stored outside the affected system or network. Even retrieving a previous version of the file is preferable to losing it entirely. Additionally, ransomware decryptors offer hope by exploiting vulnerabilities in encryption mechanisms, providing a means to recover files without payment. In January and February 2024 alone, four decryptors for various ransomware families were released. Exercise patience, as this option is becoming increasingly popular in combating ransomware attacks.

HOW TO REMOVE RANSOMWARE?

Before attempting any file recovery operations, it’s crucial to remove the malware first. SYSDF doesn’t vanish after completing encryption; it remains active, continuously seeking out new files to encrypt. Rest assured, it will swiftly encrypt any fresh, unencrypted files as soon as they are added to the disk.