Cyberpunk 2077 scam on Android that injects Ransomware has made almost $10,000

According to a video posted by SomeOrdinaryGames on YouTube, a Cyberpunk 2077 scam on Android has made almost $10,000 by injecting Ransomware.

This scam presents itself in the form of a Google Play Store page that can seem extremely authentic to anyone. However, the fact that the file starts downloading in the user's pre-installed browser and not as a direct download from the Google Play Store is a glaring indication towards malware.

On top of that, Cyberpunk 2077 has a file size of more than 100 GBs after the post-release patches, whereas the the webpage displays the game size to be 3.4 GBs. Additionally, the downloaded file's size is a little over than 3 MBs, another massive red flag.

Additionally, the application asks permission to access the user's entire device data, which is literally the final chance for the user to back out of the scam.

New Android #Ransomware disguised as #Cyberpunk2077 game.Downloaded from fake website imitating Google Play Store.Extension: .coderCryptFamily: CoderWare/BlackKingdom https://t.co/JBudDP6vG1 pic.twitter.com/TdM4SAkFWl

— Tatyana Shishkova (@sh1shk0va) December 16, 2020

Here's everything to know about the Cyberpunk 2077 android scam which made almost $10,000.

---

Android scam using Cyberpunk 2077

As can be seen in the video posted by SomeOrdinaryGamers, once the user grants the Cyberpunk 2077 ransomware with permission to access device data, a screen pops up on the users screen. This screen states that the user has been hit by "CoderWare" and that all the files on the concerned device, has been encrypted.

The message further states that the can unlock their files with a decryption key. The decryption key will be provided to the user only after the user deposits $500 to the bitcoin address provided in the message. Additionally, an email address and telegram ID is also presented in the message.

Ransomeware message (Image via sh1shk0va on Twitter)

The message also states that the user will need to send a receipt confirming their payment to the bitcoin address mentioned via mail. Only after the user completes all these tasks, the hacker assures to provide them with the key to decrypt their files.

According to the message, all the decrypted files will be deleted for good if anyone fails to complete the entire process within 10 hours. Although the video showed more than 25 transactions already being made for an amount over $9,500, it is extremely unlikely that the hacker would ever respond to anyone once they have their money.

However, the video posted by SomeOrdinaryGamers showed the decryption key being used by the hackers. For anyone who has fallen victim to the scam and needs a decryption key to fix it, here's the key: 21983453453435435738912738921

Looks this Android ransomware is related to the above: https://t.co/6PV2WSJZgj

— MalwareHunterTeam (@malwrhunterteam) December 16, 2020

The video also consisted of a similar scam for Cyberpunk 2077 on PCs, fortunately, the decryption key for PCs is also the exact same as the Android version. Additionally, the pop-up message upon executing the application is also the same on both the platforms. This includes the name of group, CoderWare, as well as the CRYPTO encryption type.