---
title: Syrk Ransomware Delivers Encryption Payload via PowerShell Script
description: We took a deep dive into the insidious Syrk ransomware strain that targets young Fortnite players to deliver a debilitating encryption payload complete with Cryptolocker anti-monitoring and self-defense capabilities. Learn how this threat to your system works and how Acronis can help you overcome it to keep your files safe.
canonical_url: https://www.acronis.com/en/blog/posts/syrk-ransomware-delivers-encryption-payload-powershell-script/
locale: en
last_updated: 2026-10-27
---

[Acronis Blog](https://www.acronis.com/en/blog/)
# Syrk Ransomware Delivers Encryption Payload via PowerShell Script

We took a deep dive into the insidious Syrk ransomware strain that targets young Fortnite players to deliver a debilitating encryption payload complete with Cryptolocker anti-monitoring and self-defense capabilities. Learn how this threat to your system works and how Acronis can help you overcome it to keep your files safe.

[Try Now](https://www.acronis.com/en/products/cloud/trial/)

[![Image 2: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)](https://www.acronis.com/en/blog/authors/acronis-security-team/ "MSP Threats Security Team")

[MSP Threats Security Team](https://www.acronis.com/en/blog/authors/acronis-security-team/)

6 min read

Last updated 26 December 2019

Advanced tech users tend to follow new products and trends in topics that interest them. Unfortunately, the “bad guys” are quick to benefit on these trends. Often, to spread their malware, attackers use hacks, guides, and more for popular games and other software. That's how users of the popular game, Fortnite, became the target of the attackers who created Syrk ransomware.

The sample of Syrk ransomware we analyzed was reported by [Leo](https://twitter.com/leotpsc/status/1156875558174769152) in August 2019. The ransomware is aimed at Fortnite cheaters, masquerading as a utility for hacking the game. However, instead of getting the desired aimbot, players download malware that immediately starts encrypting files, adding the ‘.Syrk’ extension to them.

The key features of this ransomware:

*   Mimics a popular Fortnite hacking utility
*   Encryption payload is implemented as a script that uses PowerShell crypto modules.
*   Cryptolocker has anti-monitoring and self-defense capabilities to prevent its shut down.

It’s the type of threat that anti-malware software is usually bad in dealing with.

## Static Analysis

The ransomware file is PE32 executable for Microsoft Windows. It is 12.85 megabytes in size. The payload code is written and compiled in Microsoft Visual C# / Basic .NET. The compilation time date stamp is fake and points to May 23, 2038. Apparently, the attackers tried to hide the date when the attack was prepared.

![Image 3: Syrk ransomware falsified time and date](https://staticfiles.acronis.com/images/content/c665032c49254e9cc8fd5c39d834c3d3.png)

Syrk ransomware falsified time and date

**SHA256:**

077eee74b8f1227707b389a953234756d3bf8b78108a24f132bd5feb209dd8f6

## Installation

After starting, the ransomware performs the following actions:

It pings ‘gr9wgs94fg5sb3y8l.000webhostapp.com’ address to let attackers confirm the infection.

Then it copies ‘SydneyFortniteHacks.exe’ and places the copy in ‘C:\Users\Public\Documents\’. Windows Defender and User Account Control (UAC) are disabled through a registry tweak by the next step, but to disable UAC a system restart is needed, so it is active.

![Image 4: Syrk ransomware's infection SydneyFortniteHacks.exe](https://staticfiles.acronis.com/images/content/a1d417163ba49d4b9bf61323c416b2eb.png)

Syrk ransomware's infection SydneyFortniteHacks.exe

Finally, the ransomware drops the ransomware payload file ‘cgo46ea565sdfse7.exe’ in ‘C:\Users\Public\Documents\’.

![Image 5: Syrk ransomware dropping it's payload file](https://staticfiles.acronis.com/images/content/9af73c5aa01bb3d03deed60b51587eb4.png)

Syrk ransomware dropping it's payload file

## Encryption

Syrk ransomware uses the Hidden-Cry encrypter, the source code of which is available on Github. This provides us with an opportunity to analyze how it works. Hidden-Cry appeared at the end of 2018 but didn’t see much use until it was included in Syrk ransomware.

The standard ability of Windows, Windows Cryptography API, is used to perform the encryption and decryption by Hidden-Cry.

The ransomware executes cgo46ea565sdfse7.exe. It drops the following batch scripts that perform encryption:

%USERPROFILE%\Documents\WindowsPowerShell\Modules\Cipher\Cipher.psm1

%USERPROFILE%\Documents\WindowsPowerShell\Modules\Cipher\cry.ps1

![Image 6: Syrk ransomware encrypting files](https://staticfiles.acronis.com/images/content/dac210083a45f68fbcb5aa26a3dadea1.png)

Syrk ransomware encrypting files

It imports Cipher.psm1 and tries to encrypt files with the following extensions using AES-256-CBC:

_*.gif, *.sln, *.docx, *.php, *.psd, *.ico, *.mov, *.xlsx, *.jpg, *.xls, *.doc, *.pdf, *.wav, *.pptx, *.ppt, *.txt, *.png, *.bmp, *.rar, *.zip, *.mp3, *.mp4, *.avi_

An initialization vector is generated randomly for each file. It is 16 bytes in length and is stored at the beginning of each encrypted file.

![Image 7: Syrk ransomware adding initialization vectors](https://staticfiles.acronis.com/images/content/d8514cd6bb83fccac5f668293db35314.png)

Syrk ransomware adding initialization vectors

The key in the Base64 format ‘NDZlODRmYzNlYTJhMDFlMTUwZDE3YzdiMmQzN2JhN2Q=’ can be found in %USERPROFILE%\Documents\WindowsPowerShell\Modules\Cipher\cry.ps1

![Image 8: Syrk ransomware import-module cipher](https://staticfiles.acronis.com/images/content/26da59527bc2fbd75914a8cf91f2c2be.png)

Syrk ransomware import-module cipher

The ransomware then drops the file ‘startSF.exe’ in C:\Users\Public\Documents\. It’s needed to move ‘SydneyFortniteHacks.exe’ to the new directory location: ‘%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\SydneyFortniteHacks.exe’.

![Image 9: Syrk ransomware moving .exe file to new location](https://staticfiles.acronis.com/images/content/5eeab13fedd24c398a7b5ba6af287909.png)

Syrk ransomware moving .exe file to new location

"C:\Windows\system32\cmd"

"C:\Users\admin\AppData\Local\Temp\A79F.tmp\A7A0.tmp\A7A1.bat”

“C:\Users\Public\Documents\startSF.exe"

The ransomware prevents its process from terminating by monitoring the following tools and killing them once an activity is detected:

*   Taskmgr
*   Procmon64
*   ProcessHacker

![Image 10: Syrk ransomware prevents shutdown via Taskmgr](https://staticfiles.acronis.com/images/content/58b844c7193c410deaf6c3b7268ac254.png)

Syrk ransomware prevents shutdown via Taskmgr

![Image 11: Syrk ransomware prevents shutdown via Procmon64](https://staticfiles.acronis.com/images/content/323fe779842795e881494471f52e6e64.png)

Syrk ransomware prevents shutdown via Procmon64

![Image 12: Syrk ransomware prevents shutdown via ProcessHacker](https://staticfiles.acronis.com/images/content/1176d04fa159c9d0e8d181c5a9d58781.png)

Syrk ransomware prevents shutdown via ProcessHacker

Clicking “Show My ID” in the ransom window opens another window that displays a unique ID and asks for the password to decrypt your files.

## Password Generation

This password is generated by the ‘random.Next()’ method based on ‘TickCounter’ and contains 26 symbols. ‘C:\Users\Default\AppData\Local\Microsoft\-pw+.txt’ file contains the password.

![Image 13: Syrk ransomware random password generation](https://staticfiles.acronis.com/images/content/600d1038f5343e614a62372eaaef08dc.png)

Syrk ransomware random password generation

![Image 14: Syrk ransomware password generation](https://staticfiles.acronis.com/images/content/80e3e3e6e697f1b1a0d0f12e264ddd84.png)

Syrk ransomware password generation

## Decryption

If the correct password is entered, the DeCryptor will be started. It drops and executes C:\Users\Public\Documents\dh35s3h8d69s3b1k.exe.

![Image 15: DeCryptor process in Syrk ransomware](https://staticfiles.acronis.com/images/content/0c29a83b66bad4e6081c42b8ee17c328.png)

DeCryptor process in Syrk ransomware

## Ransom Note

The ransom note is pretty simple and straightforward:

![Image 16: Syrk ransomware ransom note](https://staticfiles.acronis.com/images/content/6cc03e78bea6e406c739dae58b837d54.png)

Syrk ransomware ransom note

## Final clean up

Then Delete.exe is dropped and executed, which deletes the following files:

*   C:\Users\Public\Documents\dh35s3h8d69s3b1k.exe
*   C:\Users\Public\Documents\cgo46ea565sdfse7.exe
*   C:\Users\Public\Documents\startSF.exe
*   C:\Users\Default\AppData\Local\Microsoft\+dp-.txt
*   C:\Users\Default\AppData\Local\Microsoft\-i+.txt
*   C:\Users\Default\AppData\Local\Microsoft\-pw+.txt

## Conclusion

Syrk differs from conventional ransomware by using the PowerShell script for encryption and dropping multiple files to perform different operations. The Cryptolocker also has anti-monitoring and self-defense capabilities. It uses one-tier encryption (AES) and stores the password for encryption in the text file that can be used to restore the user’s encrypted files. Another way to decrypt the victim's files is to extract the AES file encryption key from the Cryptolocker’s PowerShell script to create a decryptor.

Fortunately, [Acronis Backup](https://www.acronis.com/en-us/business/backup/) and [Acronis True Image](https://www.acronis.com/en-us/personal/computer-backup/) can protect your computer against Syrk ransomware – and service providers can protect their customers with [Acronis Backup Cloud](https://www.acronis.com/en-us/cloud/service-provider/backup/). That’s because these [cyber protection](https://www.acronis.com/en-us/cyber-protection/) solutions not only offer backup, they also include award-winning [Acronis Active Protection](https://www.acronis.com/en-us/active-protection/), our AI-enabled and behavior-based technology that is uniquely able to deal with zero-day ransomware threats.

![Image 17: Acronis Backup detects and eliminates Syrk ransomware](https://staticfiles.acronis.com/images/content/a58118f9672b37e017a66e6d927ddfd1.png)

Acronis Backup detects and eliminates Syrk ransomware

## IoCs

C:\Users\Public\Documents\dh35s3h8d69s3b1k.exe

SHA256: 08baaf7c861748b227a93e41e28f99a258eb4ce149fa31b7ffe93bc23e385709

C:\Users\Public\Documents\cgo46ea565sdfse7.exe

SHA256: c239d501439b776e93085925eb132ff164b1f3ba4fdc356a00045e8674dc1387

C:\Users\Public\Documents\startSF.exe

SHA256: 31c3e1c03b15347bf8184854e65261a81ba12db0dcf3aeb5344ced6d8321ddf1

[Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/)  
[Cyber protection](https://www.acronis.com/en/blog/tags/cyber-protection/)

## Written by

![Image 18: MSP Threats Security Team](https://staticfiles.acronis.com/images/content/1578b8dff96325855c4525d865e7fc63.png)

MSP Threats Security Team

[Previous post](https://www.acronis.com/en/blog/posts/acronis-accelerated-growth-gets-added-boost-goldman-sachs-147-million-investment/)  
[Acronis’ Accelerated Growth Gets an Added Boost from Goldman Sachs’ $147 Million Investment](https://www.acronis.com/en/blog/posts/acronis-accelerated-growth-gets-added-boost-goldman-sachs-147-million-investment/)

[Next post](https://www.acronis.com/en/blog/posts/three-most-important-takeaways-spiceworks-spiceworldatx/)  
[The Three Most Important Takeaways from Spiceworks’ #SpiceWorldATX](https://www.acronis.com/en/blog/posts/three-most-important-takeaways-spiceworks-spiceworldatx/)

About Acronis

Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland.

[Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com)

## Related stories

Want to learn more? Read the latest stories featuring this solution on our blog.

[Acronis Blog](https://www.acronis.com/en/blog/)

![Image 19: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png)

[stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/)

We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain.

**October 26, 2026**3 min read

![Image 20: Introducing New Acronis CEO: Prakash Panjwani](https://staticfiles.acronis.com/images/blog-card/30cb571f6f1aaa131733e5727a4a250c.png)

[Introducing New Acronis CEO: Prakash Panjwani](https://www.acronis.com/en/blog/posts/introducing-new-acronis-ceo-prakash-panjwani/)

We are pleased to announce the appointment of our new Chief Executive Officer, Prakash Panjwani. A veteran cybersecurity CEO, Panjwani previously served as CEO of WatchGuard Technologies and SafeNet.

**October 15, 2026**2 min read

![Image 21: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png)

[Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/)

Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity.

**October 13, 2026**6 min read