The action role-playing video game Cyberpunk 2077 has been one of the most awaited game in the recent times and after multiple delays the game finally released in December 2020. Even though the game had bugs and issues during the initial release, it garnered massive popularity and following during the initial release window. This attracted the attention of gamers and non-gamers alike, unsurprisingly malware writers and scamsters also started taking advantage of this popularity.

Fake download sources

Even though this game is not natively available on mobile devices like Android and IPhone, there are multiple sources that advertise Cyberpunk’s availability on these devices:

• A number of websites host downloadable files with the name Cyberpunk, but they request for “verification” before the download can start. This verification usually lead to online “survey scam” websites which are after the users personal information:

 

• There are a number of youtube videos that claim to show how to download and play Cyberpunk on mobile devices. Most of these videos direct users to websites that further lead to verification scams as highlighted above, some of the websites lead to android apps :

Different types of apps

We observed a number of different types of fake Cyberpunk named apps for Android, few of them are listed below:

 

Verification apps

These apps contain Cyberpunk game related assets files like icons and menu videos. These menu and intro videos get played once the app runs making them look authentic to the user. But once the video is displayed the user is forwarded to verification/online survey links.

• MD5: 0766e628c6e6cf2048a6f6d007db4343
• Package name: com.codwarzone.neta
• Application name: Cyberpunk 2077

 

While not inherently malicious, these apps direct the users to sites that serve online survey scams. These scams try to extract sensitive user information and further misuse this information by selling it to data brokers, using it for phishing/spam/identity theft.

 

Ransomware

This app is a ransomware that uses the popularity of Cyberpunk to infect victims and demand ransom in the form of Bitcoin.

• MD5: cbd92757051490316de527a02ac17947
• Package name: com.codwarzone.neta
• Application name: Cyberpunk 2077 Mobile (Beta)

The ransom message is hardcoded in the code:

 

This malware appends the extension “.coderCrypt” at the end of files

 

The ransomware demands ransom to be sent to the Bitcoin wallet address 336Fvf8fRrpySwq8gsaWdf7gfuGm5FQi8K. Below is the recent activity on this address:

 

Malware creators are yet again using the popularity of a game to spread their malicious creations. Right now Cyberpunk 2077 is not available natively for mobile devices, it can however be played on mobile by game streaming services such as Stadia. So any video or post that claims to show how to install this game on a mobile device is likely a fake.

 

SonicWall Capture Labs provide protection against this threat with the following signatures:

• AndroidOS.CodeWare.RSM (Trojan)
• AndroidOS.Injector.VF (Trojan)

 

Indicators of Compromise (IOC’s):

• cbd92757051490316de527a02ac17947
• 0766e628c6e6cf2048a6f6d007db4343

Updated January 15, 2021

The U.S. Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA) have confirmed that malicious threat actors have been and are actively exploiting vulnerabilities in SolarWinds Orion products, specifically affected versions 2019.4 through 2020.2.1 HF1.

 

The threat actor primarily leverages a malware commonly known as SUNBURST to conduct a global supply-chain attack against the SolarWinds Orion platform. SolarWinds Orion is an enterprise-grade IT monitoring solution.

 

This malware was seen being distributed as part of SolarWinds Orion software updates from March 2020.  As part of the software update, this malware comes in the form of a dynamic linked library (DLL) that was digitally signed by SolarWinds.  Once loaded by legitimate SolarWinds.BusinessLayerHost.exe or SolarWinds.BusinessLayerHostx64.exe, this malware is capable of transferring data, file execution, system profiling, rebooting and more.

 

Apart from being digitally signed, this malware employed other evasion tactics.  These include employing Teardrop, which is a memory only dropper, to deploy a customized Cobalt Strike beacon.  It also encoded strings such as domain names, user-agents, registry keys and others.

 

A few of the notable encoded strings are as follows:

• 583da945-62af-10e8-4902-a8f205c72b2e -> This is the name of a named pipe which will be used as a mutex to avoid multiple instances of the malware from running.
• avsvmcloud[.]com -> one of the domain names this malware connects to.
• SolarWindsOrionImprovementClient/3.0.0.382 -> the User-Agent field the malware will use during HTTP communication to the C&C Server

 

The Command & Control traffic is also difficult to detect as it was designed to mimic legitimate SolarWinds API calls.  Unlike other botnet malware which connects to their C&Cs in a regular basis, SUNBURST only communicates to the malicious server once every 12 to 14 days.

 

SolarWinds has confirmed the attack and has asked impacted customers using Orion to immediately upgrade to 2019.4 HF 6 or 2020.2.1 HF 1. Please visit www.solarwinds.com/securityadvisory for more information about your Orion upgrade options.

 

Both SolarWinds and the CISA strongly suggest that organizations using SolarWinds Orion verify the version they’re running and upgrade immediately, if required.

 

SonicWall Capture Labs threat researchers have investigated the vulnerability and published multiple signatures in different categories that identify malicious activity against affected SolarWinds Orion versions. It includes application identification signatures that detect if an organization has SolarWinds Orion deployed within its network; malicious domain signatures; malicious IPs; malware such as Sunburst, Supernova and Teardrop. These signatures are applied automatically to SonicWall firewalls with active security subscriptions.

Application signatures – identify SolarWinds Orion applications:

• 15296: BUSINESS-APPS SolarWinds Orion (API Activity)
• 2014: BUSINESS-APPS SolarWinds Orion (Update Activity)

IPS signatures – identify malicious domains:

• 15292: SolarWinds Supply Chain Malware Activity 1
• 15293: SolarWinds Supply Chain Malware Activity 2
• 15294: SolarWinds Supply Chain Malware Activity 3
• 15295: SolarWinds Supply Chain Malware Activity 4
• 15298: SolarWinds Supply Chain Malware Activity 5
• 15299: SolarWinds Supply Chain Malware Activity 6
• 15300: SolarWinds Supply Chain Malware Activity 7
• 15301: SolarWinds Supply Chain Malware Activity 8
• 15302: SolarWinds Supply Chain Malware Activity 9
• 15303: SolarWinds Supply Chain Malware Activity 10
• 15308: SolarWinds Supply Chain Malware Activity 11
• 15309: SolarWinds Supply Chain Malware Activity 12
• 15310: SolarWinds Supply Chain Malware Activity 13
• 15311: SolarWinds Supply Chain Malware Activity 14
• 15312: SolarWinds Supply Chain Malware Activity 15
• 15313: SolarWinds Supply Chain Malware Activity 16
• 15314: SolarWinds Supply Chain Malware Activity 17
• 15315: SolarWinds Supply Chain Malware Activity 18
• 15316: SolarWinds Supply Chain Malware Activity 19
• 15317: SolarWinds Supply Chain Malware Activity 20

GAV signatures – identify malwares: [Updated on Jan 14]

Sunburst – Backdoor malware that has been trojanized into multiple SolarWinds Orion update versions.

• SunBurst.A (Trojan) IOC:d0d626deb3f9484e649294a8dfa814c5568f846d5aa02d4cdad5d041a29d5600
• SolarWinds.DL (Trojan), IOC:ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6
• SunBurst.A_1 (Trojan), IOC:32519b85c0b422e4656de6e6c41878e95fd95026267daab4215ee59c107d6c77
• SunBurst.A_2 (Trojan), IOC:ad2fbf4add71f61173975989d1a18395afb8538ed889012b9d2e21c19e98bbd1
• SunBurst.A_3 (Trojan), IOC:019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134

Supernova – a webshell planted in the code of the Orion network and applications monitoring platform and enabled adversaries to run arbitrary code on machines running the trojanized versions of the software.

• Injector.DN_35 (Trojan) IOC:c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71
• Supernova.A_1 (Trojan), IOC:1c96021ac8cb52173e762f6b008fb4c6e5ef113e6baa4e2cf4848e88c61d9700

Teardrop – a memory only dropper that runs as a service

• Teardrop.B (Trojan), IOC:6e4050c6a2d2e5e49606d96dd2922da480f2e0c70082cc7e54449a7dc0d20f8d

Domain Blacklist: [Updated on Jan 15]

• avsvmcloud.com
• digitalcollege.org
• freescanonline.com
• deftsecurity.com
• thedoccloud.com
• virtualdataserver.com
• incomeupdate.com
• databasegalore.com
• panhardware.com

 

SonicWall products and real-time security services can help organizations identify and mitigate SUNBURST malware and other attacks against vulnerable SolarWinds Orion versions.

 

To verify you have the latest SonicWall Intrusion Prevention Signatures (IPS), please follow the steps in this knowledgebase (KB) article: https://www.sonicwall.com/support/knowledge-base/detailed-information-on-intrusion-prevention-signature-ips-signature-ids/170505742887527/

 

SonicWall Threats Research team came across an Android spyware that steals sensitive user information and sends it to the attacker. The app has a plethora of functionalities that are centered towards stealing information from the device. However a more concerning element of the malware is that all the stolen information is transmitted over an unsecured http channel.

Infection Cycle

Details of the sample analyzed:

• MD5:5c698417916ab2a9df1d577507be5725
• App Name: 19금 틱톡 (19 gold tiktok)
• Package Name: com.yjx.callservice

Upon installation the app is visible in the app drawer as follows:

Upon execution the app starts communicating with the attacker using the hardcoded IP 116.193.152.176:7788. The communication happens over http which indicates that any user information sent to the user is done so over an unsecured channel. One of the first things done by the app is creating a unique id for the infected device, this id is saved in the shared_prefs file locally and then shared with the attacker to report the initial infection. This is performed using a POST request to addNewUser as shown below:

The malware then sends the following data from the infected device:

• Contacts on the device are sent to addContactes (notice the spelling error):

• Apps installed are sent to addAppes (another spelling mistake):

 

There are additional interesting API requests present in the code that highlight the features and capabilities of this malware:

• addNewAccount
• addNewCallloges
• addNewLocation
• addNewSmses
• getAllBlackList
• editUserMobileNetwork
• findCall
• getRealPhone
• getAllIncoming
• uploadFile

 

Functionalities in the code

The malware is capable of communicating with the attacker using webSocket. The malware can execute the following functionality based on the code received via webSockets:

• take_photo

• start_record

There are additional traces in the code which reveal more functionality of the malware. It is capable of the following:

• Steal all the SMS on the device:

• Steal the call logs from the device:

• Steal all contacts:

• Get all apps installed on the device, we saw this functionality being used via network communication earlier:

 

Additional investigation

• A network graph of the attacker’s domain reveals two additional apps that communicate with it:

 

• The two apk’s related to this campaign have similar functionality. Below are the MD5’s:
  • e8509b2a57423a1b4b2d8bcf33973974
  • b67d42100440dd6c03b56da2c71b5130

 

• The hardcoded attacker’s  domain opens a login page. As mentioned before this happens over http, as a result any sensitive information can be further snooped by someone else:

 

• Following hardcoded information is present in the code:

Attacker server IP:

Gmail credentials:

QQ chat id:

Overall this malware is geared towards stealing sensitive user information from an infected device. The log messages and text present in the code is Korean, additionally the language used on the attacker’s server login is Korean as well.

 

SonicWall Capture Labs provide protection against this threat with the following signature:

• Banker.SP (Trojan)

Indicators of Compromise (IOC’s):

• 5c698417916ab2a9df1d577507be5725
• e8509b2a57423a1b4b2d8bcf33973974
• b67d42100440dd6c03b56da2c71b5130