How to remove Cyberpunk 2077 virus

Cyberpunk 2077 virus – a fake version of a popular video game that installs Raccoon malware on a Windows computer

Cyberpunk 2077 virus is a term used to describe malware that is hiding behind one of the most anticipated video game titles of the year. Users download the virus when they visit insecure third-party torrent, crack, or warez websites that offer the pirated version of the game. While the original cost reaches as much as $59.99, users who want to avoid payments resort to cracked versions of the game. This, unfortunately, often does not end well, as players end up infecting their PCs with malware.

While many malicious programs can hide behind Cyberpunk 2077 virus, researchers have found that threat actors tend to hide info-stealing Trojan known as Raccoon. Once installed, malware is capable of stealing login credentials, financial details, as well as other sensitive user data. Creators of the strain operate a Malware-as-a-Service,^[1] which allows various actors to access the fully-functional info-stealer, providing regular bug fixes and feature updates.

Cyberpunk 2077 is an Action Role-Playing Game (RPG) released by polish developer CD Projekt Red. Almost eight years in development, intense marketing campaigns brought this title to the very top – almost 8 million preorders were made, and the global game's release managed to crash Steam and Gog functions due to overload.

Such intense attention did not bypass cybercriminals, of course, as it is not uncommon for them to abuse the latest trends and titles that are highly consumed. Previously to Cyberpunk 2077 virus, bad actors also released fake mobile games for Fortnite or Valorant, which, once installed, would steal sensitive user data or allow the attackers to take full control over the infected computer.

Cyberpunk 2077 virus on mobile was also recently discovered. According to Kaspersky security researcher Tatyana Shishkova,^[2] Android malware is spread via a fake Google Play website. It allows the attackers to encrypt all personal files, appending .coderCrypt extension to them, later asking for $500 for data return.

Thousands of websites spread pirated programs, a large amount of which are video games. Users need to install it and then apply the so-called crack, which would bypass the regular registration processes and allow playing the game for free. Without a doubt, such practice is illegal, although up to this day, millions of clicks are made each day when trying to download pirated software.

The worst part is that most security applications would flag malicious code within the cracks or installers, but users choose to ignore these warnings. Here's one of the samples that are detected as follows by various security vendors, according to Virus Total:^[3]

• Trojan.GenericKD.45092211
• Win32.Trojan-Stealer.Raccoon.B5RA2F
• Win32.Outbreak
• Trojan.MalPack.GS
• BehavesLike.Win32.Trojan.hc, etc.

Raccoon Trojan is MaaS malware that is relatively cheap on the underground forums ($75/week or $200/month),^[4] so many malicious actors are using and spreading it around the web via various methods. As evident, this time, criminals are using fake websites and torrents to spread it around. Despite being inexpensive, the Trojan is rich in its performance and capabilities, making it one of the most popular malware of such type.

Once installed, the malware behind the fake version of Cyberpunk 2077 connects to a remote Command & Control server controlled by the attackers. For the setup, several commands are used:^[4]

The malware generates an ID for the machine from MachineGuid, which is a quite common ID (query this registry keyHKLM\SOFTWARE\Microsoft\Cryptography for the value MachineGuid) and from the current username (calling to GetUserNameA).

It creates the next machine profile bot_id=%machineGUID%_%username%&config_id=%configID%&data=null and encoded the string as base64.

What’s left is to send the machine profile to the C&C. It connects the encoded base64 string to params= and sends a POST request with params=%base64MachineProfile% as the content of the request.

It is then used to transfer all the stolen information and also would allow cybercriminals to enforce a set of malicious commands. For example, it could allow the infiltration of other malicious software that would further compromise the computer, all without victims having a clue about it.

Once installed, Raccoon targets most Chromium-based browsers, including Google Chrome or Opera, and is also capable of stealing data from Mozilla Firefox. Mozilla-based email client Thunderbird is also affected, so all the content of written messages, cryptocurrency wallets, usernames and passwords, technical device information, etc., are harvested and sent over to a remote C2 server.

Cybercriminals can abuse this data in various ways. For example, they might sell it to other actors that would use the information for fraud or phishing. Without a doubt, nobody wants to end up with stolen sensitive information like that.

Thus, if you attempted to download a fake version of the game, you should immediately take action to perform a full Cyberpunk 2077 virus removal with the help of powerful security apps – we recommend using SpyHunterCombo Cleaner or MalwarebytesMalwarebytes. Since malware can affect various computer functions and settings, many users might suffer from stability issues after the malware is eliminated.

If you experience lag, crashes, errors, and other issues after you remove Cyberpunk 2077 virus from your system, we recommend trying FortectIntego repair software that would be able to fix various underlying issues within the Windows environment and ensure that it is at its best condition. It is important to note that game crashes, lag, and other issues might not necessarily be related to malware (some technical issues with the game might be fixed). However, it is very important to make sure that it is not the case to avoid the severe ramifications of the infection.

Stick to the original version of the game and avoid torrents

Torrent sites such as Pirate Bay attract millions of users regularly. This makes torrent and similar sites a perfect ground for cyberattacks, and criminals are constantly abusing the popularity of such high-risk websites, all while being extremely successful. For example, one of the most widespread ransomware strains known as Djvu is distributed via software cracks and pirated program installers and is hugely successful at doing that. Latest malware samples, such as Omfl or Booa, can infiltrate your machine easily and encrypt all data, later asking for a ransom in Bitcoin for a decryption tool.

That being said, as much as security researchers warn users about dangers that lurk on the torrent and similar sites, the malware remains successful in infecting thousands daily. Therefore, you should not give in to temptation and attempt downloading pirated programs not only because it's illegal and causes financial losses to creators but also because it can result in malware infection. Instead, you should look for an alternative for the game or simply buy it on official platforms such as Steam, GOG, or Epic Games Store.

You must never ignore warnings from your security software, as this is one of the main reasons why so many people get infected via software cracks. These tools are usually flagged by anti-virus programs regardless if they actually carry malicious code within them (this happens due to the fundamental feature of the tool, which includes breaking the code of another software).

Remove Cyberpunk 2077 virus from your system

The cybercrime theme is very prevalent within the actual game. While you dive in deep, don't forget that if you used an illegal installer, your computer might be compromised by Raccoon malware. Therefore, you should immediately take action to remove Cyberpunk 2077 virus from your computer as soon as possible.

While malware elimination is possible without employing automated tools, it is not recommended for regular computer users. Malicious programs perform a massive amount of changes within the system, drop malicious files, and alter presets to ensure that malware operates without any difficulties. Therefore, you should employ SpyHunterCombo Cleaner, MalwarebytesMalwarebytes, or another reputable anti-malware for Cyberpunk 2077 virus removal. Sometimes, malware might interfere with your security software – we advising using Safe Mode with Networking in such a case (we explain how below).

Since malware is hiding behind the fake game version of the game is an info-stealer, you should clean your machine with security software, use FortectIntego to repair possibly damaged system files, and then change all your passwords on all your accounts. It is also recommended to follow the online banking history to ensure no funds are being leaked.