FBI screen locker trojan poses as Fortnite mod

The Sonicwall Capture Labs Threats Research Team have come across malware purporting to be a mod for the popular online multiplayer game Fortnite.  Mods for such popular games are commonplace and it is quite typical that they will be laden with malware.  Unlike most ransomware nowadays this malware is a simple lockscreen trojan and does not encrypt files and hold them ransom.  Another unusual element is that payment is small at $100 USD.  Rather than demanding crypto for payment, the victim is required to load $100 USD onto a prepaid credit card and submit the card details to the operator via email.

The Trojan uses the following Fortnite icon:

Upon infection the Trojan adds the following key to the registry to enable persistence after reboot:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Epic Games “<original run location>”

It does not add or modify any files on the filesystem.

The executable file contains the following metadata:

It displays the following page in fullscreen mode:

The page is locked on the screen and cannot be removed unless the correct code is entered.  After reboot, it is displayed again due to the added registry key.

The “About Visa Gift Cards” button shows the following messagebox:

The “Help” button shows the following messagebox:

The “About” button shows the following messagebox:

We contacted the operator concerning payment and received the following reply:

Fortunately, the unlock code (290274887) is publicly known.  The following message is displayed once the code is entered:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signature:

• GAV: FBILocker.RSM (Trojan)

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets cross-vector threat information from the SonicWall Capture Threat network, consisting of global devices and resources, including more than 1 million security sensors in nearly 200 countries and territories. The research team identifies, analyzes, and mitigates critical vulnerabilities and malware daily through in-depth research, which drives protection for all SonicWall customers. In addition to safeguarding networks globally, the research team supports the larger threat intelligence community by releasing weekly deep technical analyses of the most critical threats to small businesses, providing critical knowledge that defenders need to protect their networks.