FCrypt Ransomware

If personal documents, photos, images, archives, and audio files (among others) are important to you, FCrypt Ransomware is not a threat you want to face. It targets Windows operating systems, and its main goals include encrypting your files, making you email cyber criminals, forcing you to uninstall existing anti-virus software, as well as following further instructions that should be sent via email. Our research team doubts that this malware runs in the wild, and, most likely, it is in testing stages still. Quite possibly, the infection will never be released as a real, system-invading, file-encrypting monster. However, because this infection exists, we need to treat it as a threat. In this report, we talk about identifying, understanding, and, of course, removing FCrypt Ransomware from the Windows operating system. If you scroll down below, you will find a guide that shows how to delete the infection, but we recommend reading the report first to educate yourself and learn how to prevent malware attacks in the future.

Just like many file-encrypting threats, FCrypt Ransomware encrypts personal files. At the time of analysis, this threat was supposed to encrypt all files with .1cd, .asp, .bak, .bmp, .c, .cd, .cpp, .cdr, .dbf, .doc, .docx, .dwg, .html, .java, .jpg, .jpeg, .mdb, .mp4, .pdf, .php, .psd, .rar, .rtf, .sql, .sqlite, . svg, .txt, .xls, .xlsx, and .zip extensions. The threat generated a random MD5 hash to use as an encryption key, and it also used the AES encryption algorithm. This algorithm has been used by many other infections alike, including BSS Ransomware, CtrlAlt Ransomware, Qinynore Ransomware, and Suri Ransomware. After the attack on files, FCrypt Ransomware is meant to add the “.FCrypt” extension to all of the affected files’ names, and the yellow padlock is presented as the file’s icon. In the best case scenario, the threat does not encrypt much, and if it does, all corrupted files have copies stored in backup. Some people choose to rely on system restore point, but that is not a good idea because malware can affect it. This is why it is best if you backup files outside the operating system; for example, using cloud storage or external drive storage.

After the encryption, FCrypt Ransomware immediately creates a file on the Desktop named “#HELP-DECRYPT-FCRYPT1.1#.txt.” The file is safe to open, but paying attention to the instructions is very risky, and you can delete it right away. According to the message created by cyber criminals, you must send the TXT file to fcrypt@qq.com, then uninstall anti-virus software (if it exists at all), and, finally, wait for a response. It is stated that the attackers do not expect victims to pay money for decryption, and that is very strange because that makes the purpose of FCrypt Ransomware unclear. Was this threat created just so that someone could test malware? Maybe, but we do not know that. According to our research team, the rumor in the virtual security circles is that the files corrupted by this malware are “decryptable,” but we could not confirm it, and we cannot offer a key or a tool that would decrypt your personal files for free.

Although we do not think that FCrypt Ransomware is actively spreading, and we do not think that regular Windows users will need to defend their operating systems against this malware, it exists, and we cannot predict the moves of its creators. Hopefully, you have not faced this malware yet, and you can secure your operating system. Note that there are hundreds – if not thousands – of other threats that can actually invade your system and encrypt your files, and so reliable protection is something you need anyway. Install anti-malware software to keep your operating system protected against ransomware and other kinds of malware. If malware already exists, this software should find and remove it automatically. You might also be able to delete FCrypt Ransomware manually, but if you choose this route, make sure you are able to find and delete the launcher file, because it is most important for the attackers.

N.B. Your files are vulnerable, and although anti-malware software should provide you with a reliable defense mechanism, we suggest creating a second layer of security for your files by backing them up.

FCrypt Ransomware Removal

1. Delete the malicious launcher file (location and name unknown).
2. Go to Desktop and Delete the file named #HELP-DECRYPT-FCRYPT1.1#.txt.
3. Once you believe all components are erased, Empty Recycle Bin.
4. Install and run a malware scanner to check if your system is now malware-free.