The Fs0ci3ty Virus – Remove It and Restore Encrypted Files - How to, Technology and PC Security Forum |

The Fs0ci3ty Virus – Remove It and Restore Encrypted Files

1 Star2 Stars3 Stars4 Stars5 Stars (No Ratings Yet)


Another Fsociety themed ransomware virus is on the loose. The name is based on that of the hacker ring in the popular TV show “Mr. Robot” and is written in a semi-leet format – Fs0ci3ty. This cryptovirus will encrypt your files while adding the extension as an appendix to each of them. The price asked as a ransom is 1.5 Bitcoins, but increases with up to 1 Bitcoin on a daily basis. To see how to remove this virus and how you can try to restore your files, read the whole article.

Threat Summary

TypeRansomware, Cryptovirus
Short DescriptionThe ransomware will encrypt your files and display a ransom note in which it states the initial price for decryption of 1.5 Bitcoins.
SymptomsThe ransomware will display a ransom message after encryption is complete and lock files with the extension appended to them.
Distribution MethodSpam Emails, Email Attachments
Detection Tool See If Your System Has Been Affected by Fs0ci3ty


Malware Removal Tool

User ExperienceJoin Our Forum to Discuss Fs0ci3ty.
Data Recovery ToolWindows Data Recovery by Stellar Phoenix Notice! This product scans your drive sectors to recover lost files and it may not recover 100% of the encrypted files, but only few of them, depending on the situation and whether or not you have reformatted your drive.

Fs0ci3ty Virus – Delivery Ways

Fs0ci3ty ransomware might infect computer devices using various ways for delivery. Spam email campaigns can be delivering its payload file. Those kinds of email campaigns try to convince you that you need some update for a driver. With the electronic letter you will see a driver_update.exe file put as an attachment. There might be a document file with it that will have gibberish text inside, which will try to make you enable macros on Microsoft Word. The email will state that you need the update from the executable file. Once opened, the malicious code from the file will infect your entire PC system.

More delivery ways could be initiated for the Fs0ci3ty virus. The malware could use social media networks or file share services as outlets for the payload. The ransomware makers might have placed the driver_update.exe file on platforms like these and use them for infecting people’s systems. Try to be careful while you are surfing cyberspace. Refrain from opening files in dubious emails, and links, too. A file scan with a security application and doing a simple check for file signatures and sizes is a broadly welcomed idea. You should check out more tips for preventing ransomware in our forum topic.

Fs0ci3ty Virus – Detailed Information

The Fs0ci3ty virus is a ransomware type, which encrypts files on a compromised machine before asking for ransom. The interesting thing here is that its name is obviously inspired by the hacker group fsociety from the famous TV show “Mr. Robot”. In the show, the hackers infected computers with another, very popular cryptovirus – namely, CryptoWall ransomware.

When the Fs0ci3ty virus executes its payload file, it will then create entries in the Registry of Windows to retain persistence. These entries will most probably make the malware launch automatically with each start of the Windows operating system. Afterward, your files will get encrypted and a file called fs0ci3ty.html will be placed on your desktop. If you open this file it will load this page:


The file fs0ci3ty.html reads the following:

Welcome To Fs0ci3ty
You Will need to make a Payment of 1.5 Bitcoins within the next 24 Hours or Ransome goes to 1 Btc more daily Your File System has been encrypted using state of the art Technology
You may already understand how this works, if you do good but if you are confused or are unaware of how this works we are hoping to be more informative with our clients.
buying bitcoins can be very hard to do, so to make this more trust worthy than most we are going to have a secure cold payment system set up that will allow us to secure bitcoins.
as well as a different wallet address per client, each user is given a unique identifier by the server that is used to track distributed keys as well wallet addresses assigned.
you can head to and create a new account in seconds flat, than go to the wallet and send 1.5 btc to the address you were given in the ransome message
you will use the bitcoin you get through local bitcoins to pay to the unique wallet we gave you the identifier in the bottom left of this page is tied to your key contact us via email

As you can see above, the Fs0ci3ty ransomware gives an initial price for decryption of 1.5 Bitcoins which equals to around 920 US dollars. That is the price if you pay within the first-day time-frame. If you go over the first 24 hours, you would have to pay with up to 1 Bitcoin more for each day that has passed.

You shouldn’t pay the cybercriminals for a number of reasons. First, no one can guarantee you that you will restore your files by paying. Second, you will financially aid the crooks, and the money will be used for other criminal activity or to fund another ransomware project. Third, you might be infected again by another ransomware they make in the future. In any way, do NOT pay anything – you could be able to decrypt your files for free.

The list of file extensions which the virus seeks to encrypt is unknown contrary to the previously known Fsociety ransomware, which uses the same name but written a bit differently.

Documents, pictures, and databases are the top of the file types which could be encrypted as they are still the most widely used ones for important files by any Windows user. All encrypted files will have the extension as their appendix, after their original file name. The extension is also the contact e-mail left by the cybercriminals. The mail server Sigaint is used, which is very similar to the ProtonMail service. This is how the main page of the Sigaint mail server looks like:


The ransomware is believed to utilize a 256-bit AES encryption algorithm. The Fs0ci3ty ransomware is very likely to erase all Shadow Volume Copies from the Windows operating system. Read on to see how you can try to restore some if not all of your data.

Remove Fs0ci3ty Virus and Restore Files

If your computer got infected with the Fs0ci3ty ransomware virus, you should have some experience in removing malware. You should get rid of this ransomware as fast as possible before it can have the chance to spread further and infect more computers. You should remove the ransomware and follow the step-by-step instructions guide given below. To see ways that you can try to recover your data, see the step titled 2. Restore files encrypted by Fs0ci3ty.


Berta Bilbao

Berta is a dedicated malware researcher, dreaming for a more secure cyber space. Her fascination with IT security began a few years ago when a malware locked her out of her own computer.

More Posts

Leave a Comment

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.

Share on Facebook Share
Share on Twitter Tweet
Share on Google Plus Share
Share on Linkedin Share
Share on Digg Share
Share on Reddit Share
Share on Stumbleupon Share