Fortnite Syrk Ransomware Hack – How to Decrypt Your Files
Fortnite players are again the target of a new malware attack. The malware is disguised as a Fortnite game hack, in this case an aimbot and a wall hack discovered by Cyren. However, rather than giving the player a game cheat, the downloaded files infect their computer with Syrk ransomware. The ransomware encrypts the players’ computers and block access until a ransom is paid to unlock files. With some simple instructions, your device can be unlocked without paying the ransom money.
Syrk ransomware masquerades as Fortnite game cheat that purports to give the user higher accuracy when shooting, called an aimbot, and knowledge of other players’ whereabouts, or ESP. An aimbot is a game cheat that gives players increased aiming accuracy. A wall hack, or ESP, is another cheat that gives users the knowledge about the location of other players, as if they can see through walls.
Syrk ransomware is the open source Hidden-Cry malware with a .Syrk extension. Hidden-Cry was available to anyone using repository site Github. The ransomware was discovered by cyber security researchers at Cyren and the attack vector is broken down in their post.
How Does Syrk Fortnite Ransomware Work?
One it’s downloaded, Syrk ransomware begins to encrypt all the files on the device it was installed on. The ransomware alters Windows machines’ registry to disable Windows Defender and User Access Control.
Once the files are locked up, a countdown clock begins giving the user only two hours to pay a ransom. Taskmgr, Procmon64, and ProcessHacker processes are monitored by the malware so they infection is not terminated by the user. The ransomware encrypts files with *.gif, *.sln, *.docx, *.php, *.psd, *.ico, *.mov, *.xlsx, *.jpg, *.xls, *.doc, *.pdf, *.wav, *.pptx, *.ppt, *.txt, *.png, *.bmp, *.rar, *.zip, *.mp3, *.mp4, *.avi extensions. If the ransom is not paid, all the files on the device will supposedly be deleted when the timer expires.
What is Fortnite?
Fortnite, is an online game developed and released by Epic Games in 2017. As of March 2019, about 250 million people play Fortnite. The game is cross platform and is available on PlayStation 4, Android, Nintendo Switch, Xbox One, iOS, Microsoft Windows, and Macintosh operating systems. Fortnite gained media attention with non-gamers when a sixteen year old player won the Fortnite World Cup earning three million dollars. The tournament was viewed by over two million people.
What is Malware?
Malware is any unwanted app or software on a device. Types of malware include ransomware, adware worms, keyloggers, and spyware. Malware is sometimes called a computer virus.
Other Fortnite Hacks
Previously Fortnite malware attacks involved Baldr malware which was also a game cheat but stole sensitive account details from players. When Fortnite was offered as an Android mobile app in 2018, Epic allowed users to download the app from their own website. Circumventing the Google Play Store download security process, left version one of the Fortnite installer vulnerable to hackers who could also deliver malware during the download process.
Earlier in 2018, Fortnite accounts were compromised with hackers spending V-Bucks, make in-game purchases using the credit card attached to the account
How to Decrypt Your Files – Fortnite Hack
The best way to avoid malware and other online gaming scams is to not use games cheats. if you’re device is infected, a reasonably tech savvy person can gain control of your files and data without paying the ransom. According to the Cyren post, the files needed to unlock the encrypted files are on each infected machine. The file executable dh35s3h8d69s3b1k file is the Hidden-Cry decrypting tool and embedded in the malware. Extract the embedded file dh35s3h8d69s3b1k . exe and run it on the infected machine. It will drop the PowerShell script needed to decrypt the files.
The malware writes files that contains the password and ID.
- C:\Users\Default\AppData\Local\Microsoft\-i+.txt (contains randomly generated ID)
- C:\Users\Default\AppData\Local\Microsoft\-pw+.txt (contains password)
- C:\Users\Default\AppData\Local\Microsoft\+dp-.txt (contains ID and password)
