New Crypto-Stealing Ransomware Targets Fortnite Players
news
A new piece of ransomware called Syrk will encrypt files on your hard drive while deleting entire folders if the ransom is not paid. The malware is based on the open source Hidden-Cry program, an encryptor that appeared online last December and has been the basis for many bits of malware over the past year.
Image via Cyren
Home to some 250 million players, Fortnite users are a prime target for this kind of malware.
“Combining game malware with ransomware was inevitable,” said Chris Morales, head of security analytics at Vectra. “Social engineering through online video games has been going on for some time. It is a large audience to target and an industry that is known to look for shortcuts. Malware posing as a hack tool is novel as it will not be validated by any app store and bypasses the normal security controls. This makes encrypting files using a game hack highly opportunistic and easy to execute.”
Syrk targets Fortnite users by masquerading as a cheating app for the game. The Syrk malware appears as “SydneyFortniteHacks.exe” and when it is run the app begins encrypting files on the user’s hard drive and USB drives. If a ransom isn’t paid in crypto the app starts deleting one important folder after another, culminating in your Documents folder
“The next step is it will set a timed procedure to try and delete the encrypted files in the directories listed below, deleting the files every two hours in the following order: %userprofile%Pictures; %userprofile%Desktop; and %userprofile%Documents,” the researchers wrote.
Luckily the malware is based on a known attack vector and the software is easy to circumvent. Victims can easily unlock their computers by looking for a few text files on their drives. These files contain the passwords use to shut down the ransomware before it can delete your files, a nice feature that should stop many from having to shell out crypto for a clean computer.
password for decryption is located at:
C:UsersDefaultAppDataLocalMicrosoft-pw+.txt
‘passwordonly’
C:UsersDefaultAppDataLocalMicrosoft+dp-.txt
‘pass : password’— Fafner [_KeyZee_] (@F_kZ_) August 1, 2019
Given the ease with which users can disable the malware, it’s not clear how many victims paid the crypto ransom the creators required.
Image via Shutterstock.
