A hacker is distributing fake Windows and Android installers for the game Cyberpunk 2077 that install a ransomware called CoderWare.
To trick users into installing malware, threat actors typically distribute it as game installers and cracks for copyrighted software.
This week, Kaspersky malware analyst Tatyana Shishkova discovered an Android ransomware that pretends to be the mobile version of the game Cyberpunk 2077. The game was distributed by a fake website that pretends to be the legitimate Google Play Store.
Shishkova wrote on Twitter that the CoderWare ransomware uses a hardcoded key, meaning a decryptor can be created if necessary to recover files without payment.
“The RC4 algorithm with a hardcoded key (in this example - “21983453453435435738912738921”) is used for encryption. This means that if you have your files encrypted by this #ransomware, it is possible to decrypt them without paying the ransom.”
You can see the hardcoded key "21983453453435435738912738921" in the ransomware source code shown below.
The Windows version was released in November
This ransomware is the same as the one discovered by MalwareHunterTeam in November and disguised as a installer . Like the Android version, this ransomware is called CoderWare but is a variant of the BlackKingdom ransomware.
The Windows variant was a python that could encrypt a victim's files and append the .DEMON to the encrypted file names.
It is not known if the Windows version uses a hardcoded key at this time.
As you can see, when you try to install freeware that is protected by copyright, you face huge risks of malware. This risk is even more significant when you try to install Android apps from third-party app stores.
Information source: bleepingcomputer.com
