FBI screen locker trojan poses as Fortnite mod

July 20, 2018

The Sonicwall Capture Labs Threats Research Team have come across malware purporting to be a mod for the popular online multiplayer game Fortnite.  Mods for such popular games are commonplace and it is quite typical that they will be laden with malware.  Unlike most ransomware nowadays this malware is a simple lockscreen trojan and does not encrypt files and hold them ransom.  Another unusual element is that payment is small at $100 USD.  Rather than demanding crypto for payment, the victim is required to load $100 USD onto a prepaid credit card and submit the card details to the operator via email.

The Trojan uses the following Fortnite icon:

Upon infection the Trojan adds the following key to the registry to enable persistence after reboot:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Epic Games “<original run location>”

It does not add or modify any files on the filesystem.

The executable file contains the following metadata:

 

It displays the following page in fullscreen mode:

The page is locked on the screen and cannot be removed unless the correct code is entered.  After reboot, it is displayed again due to the added registry key.

The “About Visa Gift Cards” button shows the following messagebox:

 

The “Help” button shows the following messagebox:

 

The “About” button shows the following messagebox:

 

We contacted the operator concerning payment and received the following reply:

Fortunately, the unlock code (290274887) is publicly known.  The following message is displayed once the code is entered:

 

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

  • GAV: FBILocker.RSM (Trojan)