{"type":"bundle","id":"bundle--5aace895-0f02-4cca-8d01-6f13cb8a6498","objects":[{"type":"identity","spec_version":"2.1","id":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","created":"2026-09-15T22:16:05.172Z","modified":"2026-09-15T22:16:05.172Z","name":"ZeroHour","identity_class":"system","description":"Indicators auto-extracted from public security reporting. Verify before use."},{"type":"indicator","spec_version":"2.1","id":"indicator--48ac1bce-343f-4044-9a30-c02b7f37a2d5","created":"2026-09-14T00:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 5c92d3b8734b4f498752f735a1ca0987","description":"Seen in \"The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions\" (Elastic Security Labs). Context: n installer payload main-v2 hxxps://granderevolucao[.]store/5c92d3b8734b4f498752f735a1ca0987/{campaignId} .NET PE Injector sub-module hxxps://archive[.]","pattern":"[file:hashes.MD5 = '5c92d3b8734b4f498752f735a1ca0987']","pattern_type":"stix","valid_from":"2026-09-14T00:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Elastic Security Labs","url":"https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--cd2adbeb-edf3-4214-905e-e1f76c8d023b","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 2915b3f8b703eb744fc54c81f4a9c67f","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat","pattern":"[file:hashes.MD5 = '2915b3f8b703eb744fc54c81f4a9c67f']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--8fc01311-e4dc-42c8-bfcb-d7fc46f05ac6","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 38de5b216c33833af710e88f7f64fc98","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://talosintelligence.com/talos_file_reputat","pattern":"[file:hashes.MD5 = '38de5b216c33833af710e88f7f64fc98']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--419c33f9-98a8-4b6b-a8b1-3d3bcec3363f","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 9a47c4d379998ade2f8f99e23a630c06","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: a076ba24bdd2d0ee532ef991c1ef25a2431a19f850942ba2ab16b2 MD5: 9a47c4d379998ade2f8f99e23a630c06 Talos Rep: https://talosintelligence.com/talos_file_reputat","pattern":"[file:hashes.MD5 = '9a47c4d379998ade2f8f99e23a630c06']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--5d5bb844-2f27-4d08-87f2-352afce04af2","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: c2efb2dcacba6d3ccc175b6ce1b7ed0a","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: e6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://talosintelligence.com/talos_file_reputat","pattern":"[file:hashes.MD5 = 'c2efb2dcacba6d3ccc175b6ce1b7ed0a']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--f45a47ec-9885-4684-9c48-2dfc0ee171d6","created":"2026-09-10T18:00:15.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: f3e82419a43220a7a222fc01b7607adc","description":"Seen in \"We've got one word for it, and it's usually the wrong one\" (Cisco Talos). Context: 8fe5e1516cba35c85fc03e503bd1b5469113ffa1f1b9e10897f811 MD5: f3e82419a43220a7a222fc01b7607adc Talos Rep: https://talosintelligence.com/talos_file_reputat","pattern":"[file:hashes.MD5 = 'f3e82419a43220a7a222fc01b7607adc']","pattern_type":"stix","valid_from":"2026-09-10T18:00:15.000Z","labels":["auto-extracted","industry"],"confidence":30,"external_references":[{"source_name":"Cisco Talos","url":"https://blog.talosintelligence.com/weve-got-one-word-for-it-and-its-usually-the-wrong-one/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--622934af-43b4-4c69-a397-671359e02b13","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 0e39e8d7b641bcda4376ebbfeff7b12e","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: cluded in the malicious ISO File name / MD5 %TEMP%\\find.vbs 0e39e8d7b641bcda4376ebbfeff7b12e Script that displays the fake “license not found” message E","pattern":"[file:hashes.MD5 = '0e39e8d7b641bcda4376ebbfeff7b12e']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4b164534-939f-4436-a217-a5aafd38fb95","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 15eca4a3f7350423cf4db0b4c30d1968","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: 6ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e3","pattern":"[file:hashes.MD5 = '15eca4a3f7350423cf4db0b4c30d1968']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b7e0ca29-62ea-4eec-85fb-a82140c55708","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 1ec9eff863dc4418d1498bc3d904899d","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: haos ransomware File name / MD5 %TEMP%\\YandexPackLoader.exe 1ec9eff863dc4418d1498bc3d904899d Browser installer included in the malicious ISO File name /","pattern":"[file:hashes.MD5 = '1ec9eff863dc4418d1498bc3d904899d']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--61cd8611-514a-47de-8736-d8fa267c4d89","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 2a0834560ed3770fc33d7a42f8229722","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: %\\rockstargamescrashfixer.exe , %TEMP%\\rockstarservices.exe 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651","pattern":"[file:hashes.MD5 = '2a0834560ed3770fc33d7a42f8229722']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--1d9cae89-2ca2-4e40-84fc-0904a8ec34b7","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 2a385fe7bed9899d77d05cb8e302d557","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 NJRAT copies and associated launchers IP addresses 35.157.1","pattern":"[file:hashes.MD5 = '2a385fe7bed9899d77d05cb8e302d557']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d5491b8d-a3fa-4a29-8110-a8cb3bf79c4f","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 57b9c56ef97a7ada98257b23577bf5e3","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: TEMP%\\rockstarservices.exe 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c3","pattern":"[file:hashes.MD5 = '57b9c56ef97a7ada98257b23577bf5e3']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--40d04c8d-7e95-44e9-a749-e4ecfe43a780","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 60a0f58001ea7be538cd42b651924cc7","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: 560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee","pattern":"[file:hashes.MD5 = '60a0f58001ea7be538cd42b651924cc7']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d28e6ba1-3528-4b2a-9b38-ccd2c2d77002","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 6b49f24d5d5b49127476bc385565f8b0","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: ecutable File name / MD5 %TEMP%\\checkinternetconnection.bat 6b49f24d5d5b49127476bc385565f8b0 Batch file used to confirm internet connectivity File names","pattern":"[file:hashes.MD5 = '6b49f24d5d5b49127476bc385565f8b0']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--96a8842a-bdc6-459a-9684-bf90b0c15ce4","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 8da3fe3664d81226b0fb2a50a0537d4f","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: at , C:\\Users\\Default\\Local Settings\\[RANDOM FILE NAME].exe 8da3fe3664d81226b0fb2a50a0537d4f DCRAT installer components and binary Hosts-file entries 0.","pattern":"[file:hashes.MD5 = '8da3fe3664d81226b0fb2a50a0537d4f']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c1857bdc-b566-4d74-ae6f-4b22ffeb28c4","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: a15e280a3fd65dfaa243bbe2dbf45e97","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: ype Indicator Description File name / MD5 Gta6installer.exe a15e280a3fd65dfaa243bbe2dbf45e97 Initial fake installation executable File name / MD5 %TEMP%","pattern":"[file:hashes.MD5 = 'a15e280a3fd65dfaa243bbe2dbf45e97']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--ef26c9b3-3246-4677-b3ac-bd4bf7ea4368","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: b9648ec8cc806e7661aabcfc91dc836c","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: %TEMP%\\gta6.exe , %USERPROFILE%\\AppData\\Roaming\\svchost.exe b9648ec8cc806e7661aabcfc91dc836c Chaos ransomware binaries File name read_it.txt Note droppe","pattern":"[file:hashes.MD5 = 'b9648ec8cc806e7661aabcfc91dc836c']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--41bc44e6-810d-4048-a30f-ea8aa3cf57ef","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: dfdf5e5b78d2ec764c0e5641cf9a0d26","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: -control infrastructure File name / MD5 %TEMP%\\adminapp.exe dfdf5e5b78d2ec764c0e5641cf9a0d26 Mercurial Grabber infostealer binary URL https://discord[.]","pattern":"[file:hashes.MD5 = 'dfdf5e5b78d2ec764c0e5641cf9a0d26']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--57de9c83-2168-417c-925b-61ca3afaec55","created":"2026-09-10T14:23:36.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: ea991bc9334b36a6b958f564ee716776","description":"Seen in \"Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware\" (Cyber Security News). Context: 8001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 NJRAT copies and associate","pattern":"[file:hashes.MD5 = 'ea991bc9334b36a6b958f564ee716776']","pattern_type":"stix","valid_from":"2026-09-10T14:23:36.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-gta-6-downloads/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b2d44a89-f74f-48c1-b432-8a3cf33410ed","created":"2026-09-10T11:43:44.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 15eca4a3f7350423cf4db0b4c30d1968","description":"Seen in \"Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers\" (GBHackers). Context: 6ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e3","pattern":"[file:hashes.MD5 = '15eca4a3f7350423cf4db0b4c30d1968']","pattern_type":"stix","valid_from":"2026-09-10T11:43:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/fake-gta-6-installer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--822d8a95-b56e-4be6-9313-9f8746111c9b","created":"2026-09-10T11:43:44.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 2a0834560ed3770fc33d7a42f8229722","description":"Seen in \"Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers\" (GBHackers). Context: ckstargamescrashfixer.exe %TEMP%\\rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651","pattern":"[file:hashes.MD5 = '2a0834560ed3770fc33d7a42f8229722']","pattern_type":"stix","valid_from":"2026-09-10T11:43:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/fake-gta-6-installer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c9c79acb-72fe-4977-87ed-a9ab1e5b3013","created":"2026-09-10T11:43:44.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 2a385fe7bed9899d77d05cb8e302d557","description":"Seen in \"Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers\" (GBHackers). Context: a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associated launchers Note: IP addresses","pattern":"[file:hashes.MD5 = '2a385fe7bed9899d77d05cb8e302d557']","pattern_type":"stix","valid_from":"2026-09-10T11:43:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/fake-gta-6-installer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e742947c-dd13-4337-b99c-ffc70e1af57f","created":"2026-09-10T11:43:44.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 57b9c56ef97a7ada98257b23577bf5e3","description":"Seen in \"Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers\" (GBHackers). Context: rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c3","pattern":"[file:hashes.MD5 = '57b9c56ef97a7ada98257b23577bf5e3']","pattern_type":"stix","valid_from":"2026-09-10T11:43:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/fake-gta-6-installer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e98d98e2-3783-4da9-8440-c96e56f8b2ac","created":"2026-09-10T11:43:44.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 60a0f58001ea7be538cd42b651924cc7","description":"Seen in \"Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers\" (GBHackers). Context: 560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee","pattern":"[file:hashes.MD5 = '60a0f58001ea7be538cd42b651924cc7']","pattern_type":"stix","valid_from":"2026-09-10T11:43:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/fake-gta-6-installer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e79d0b9f-3ee5-42af-ab65-b20111b425e0","created":"2026-09-10T11:43:44.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 6b49f24d5d5b49127476bc385565f8b0","description":"Seen in \"Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers\" (GBHackers). Context: llation executable %TEMP%\\checkinternetconnection.bat MD5 : 6b49f24d5d5b49127476bc385565f8b0 BAT file used to confirm a working internet connection %TEM","pattern":"[file:hashes.MD5 = '6b49f24d5d5b49127476bc385565f8b0']","pattern_type":"stix","valid_from":"2026-09-10T11:43:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/fake-gta-6-installer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3f0c2719-d4f1-4672-a3da-6755e1764c2b","created":"2026-09-10T11:43:44.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: a15e280a3fd65dfaa243bbe2dbf45e97","description":"Seen in \"Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers\" (GBHackers). Context: -clean media. IOCs Item Description Gta6installer.exe MD5 : a15e280a3fd65dfaa243bbe2dbf45e97 Initial installation executable %TEMP%\\checkinternetconnect","pattern":"[file:hashes.MD5 = 'a15e280a3fd65dfaa243bbe2dbf45e97']","pattern_type":"stix","valid_from":"2026-09-10T11:43:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/fake-gta-6-installer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--41ee1415-3a6e-4777-a5be-3cf6b9bcf993","created":"2026-09-10T11:43:44.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: ea991bc9334b36a6b958f564ee716776","description":"Seen in \"Fake GTA 6 Installer Steals Browser Passwords, Discord Tokens and Crypto Data From Gamers\" (GBHackers). Context: 8001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associ","pattern":"[file:hashes.MD5 = 'ea991bc9334b36a6b958f564ee716776']","pattern_type":"stix","valid_from":"2026-09-10T11:43:44.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/fake-gta-6-installer/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b66ef9c9-89af-49fe-b2d3-3d675cbe54e6","created":"2026-09-10T09:53:52.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 9678f71ea4cccbc3d511dc8d7f24b113","description":"Seen in \"Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware\" (Cyber Security News). Context: 25f44db68a MacSync sample hash reported by SEQRITE MD5 hash 9678f71ea4cccbc3d511dc8d7f24b113 MacSync sample MD5 hash SHA-1 hash 59508d071661ea70fa5fcbe6","pattern":"[file:hashes.MD5 = '9678f71ea4cccbc3d511dc8d7f24b113']","pattern_type":"stix","valid_from":"2026-09-10T09:53:52.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-claude-and-chatgpt-installers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--9ef640e6-9727-46be-87b5-8b1fdba2f325","created":"2026-09-10T09:53:52.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: de62a2f47d1c7dec2997f931a050a615","description":"Seen in \"Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware\" (Cyber Security News). Context: h used for stolen-data uploads HTTP request header api-key: de62a2f47d1c7dec2997f931a050a615 API key observed in MacSync network requests HTTP User-Agen","pattern":"[file:hashes.MD5 = 'de62a2f47d1c7dec2997f931a050a615']","pattern_type":"stix","valid_from":"2026-09-10T09:53:52.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Cyber Security News","url":"https://cybersecuritynews.com/fake-claude-and-chatgpt-installers/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--436a5c5c-7292-4f26-ab59-c5626477ddaa","created":"2026-09-10T07:01:43.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 9678f71ea4cccbc3d511dc8d7f24b113","description":"Seen in \"Hackers Use ClickFix Lures to Deploy MacSync Stealer and Bypass macOS Security.\" (GBHackers). Context: b68aeadc44eeb97c9aab11 Native Mach-O Stager Binary MD5 Hash 9678f71ea4cccbc3d511dc8d7f24b113 Native Mach-O Stager Binary SHA-1 Hash 59508d071661ea70fa5f","pattern":"[file:hashes.MD5 = '9678f71ea4cccbc3d511dc8d7f24b113']","pattern_type":"stix","valid_from":"2026-09-10T07:01:43.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/clickfix-lures-target-macos/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--eaec2268-86af-4ddd-9648-e9708c50a2e2","created":"2026-09-10T05:20:30.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 528cd4e69ecfa5191adbcf6ef28667bf","description":"Seen in \"Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers\" (GBHackers). Context: Infrastructure used to execute campaign activity File hash 528cd4e69ecfa5191adbcf6ef28667bf lsa_read.exe — Rust LSA secret reader File hash ce870a91e8d","pattern":"[file:hashes.MD5 = '528cd4e69ecfa5191adbcf6ef28667bf']","pattern_type":"stix","valid_from":"2026-09-10T05:20:30.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-hundreds-of-ai-agents/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--083926a6-c2ad-49b7-992c-febf38a2fcae","created":"2026-09-10T05:20:30.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 974decb9ff4c8f9ccb0937c96d513347","description":"Seen in \"Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers\" (GBHackers). Context: sa_collect_small.exe — Rust LSA bootkey collector File hash 974decb9ff4c8f9ccb0937c96d513347 certipy.exe — Active Directory Certificate Services abuse t","pattern":"[file:hashes.MD5 = '974decb9ff4c8f9ccb0937c96d513347']","pattern_type":"stix","valid_from":"2026-09-10T05:20:30.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-hundreds-of-ai-agents/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--6aeef24b-0d13-40eb-8769-89a9958b5152","created":"2026-09-10T05:20:30.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: a6437ac3d6798090a218520985d36a3f","description":"Seen in \"Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers\" (GBHackers). Context: 687abc60b04 save_hives.exe — registry hive dumper File hash a6437ac3d6798090a218520985d36a3f collect_custom.exe — Rust custom collection tool File hash","pattern":"[file:hashes.MD5 = 'a6437ac3d6798090a218520985d36a3f']","pattern_type":"stix","valid_from":"2026-09-10T05:20:30.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-hundreds-of-ai-agents/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--a6daf228-3e0d-4bca-bcd9-80feea68a71c","created":"2026-09-10T05:20:30.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: ce870a91e8d27e8f663f0687abc60b04","description":"Seen in \"Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers\" (GBHackers). Context: f6ef28667bf lsa_read.exe — Rust LSA secret reader File hash ce870a91e8d27e8f663f0687abc60b04 save_hives.exe — registry hive dumper File hash a6437ac3d67","pattern":"[file:hashes.MD5 = 'ce870a91e8d27e8f663f0687abc60b04']","pattern_type":"stix","valid_from":"2026-09-10T05:20:30.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-hundreds-of-ai-agents/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--38160ae8-d1c9-4050-b1ab-cacfe91d791c","created":"2026-09-10T05:20:30.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: fc92dfafa7aa741c5f2b9cbcf75d1d19","description":"Seen in \"Hackers Deploy Hundreds of AI Agents to Compromise 440 PaperCut Servers\" (GBHackers). Context: collect_custom.exe — Rust custom collection tool File hash fc92dfafa7aa741c5f2b9cbcf75d1d19 lsa_collect_small.exe — Rust LSA bootkey collector File has","pattern":"[file:hashes.MD5 = 'fc92dfafa7aa741c5f2b9cbcf75d1d19']","pattern_type":"stix","valid_from":"2026-09-10T05:20:30.000Z","labels":["auto-extracted","exploit"],"confidence":30,"external_references":[{"source_name":"GBHackers","url":"https://gbhackers.com/hackers-deploy-hundreds-of-ai-agents/"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c0720776-e54c-4484-99eb-30747b4b382a","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 0e39e8d7b641bcda4376ebbfeff7b12e","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: 18d1498bc3d904899d Yandex web browser %TEMP%\\find.vbs MD5 : 0e39e8d7b641bcda4376ebbfeff7b12e Script that displays a \"license not found\" message","pattern":"[file:hashes.MD5 = '0e39e8d7b641bcda4376ebbfeff7b12e']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--105b9ac1-d2c1-4547-8a61-a53461372462","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 15eca4a3f7350423cf4db0b4c30d1968","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: 6ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e3","pattern":"[file:hashes.MD5 = '15eca4a3f7350423cf4db0b4c30d1968']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--0b094b7f-6995-46d3-bb0f-679e757fd225","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 1ec9eff863dc4418d1498bc3d904899d","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: ansomware-encrypted files %TEMP%\\YandexPackLoader.exe MD5 : 1ec9eff863dc4418d1498bc3d904899d Yandex web browser %TEMP%\\find.vbs MD5 : 0e39e8d7b641bcda43","pattern":"[file:hashes.MD5 = '1ec9eff863dc4418d1498bc3d904899d']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--e471bcb8-ea5c-4bee-bf68-f1f0e95ebe69","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 2a0834560ed3770fc33d7a42f8229722","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: ckstargamescrashfixer.exe %TEMP%\\rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651","pattern":"[file:hashes.MD5 = '2a0834560ed3770fc33d7a42f8229722']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--b1289322-8eef-445b-a7b7-a2f358b57e49","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 2a385fe7bed9899d77d05cb8e302d557","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associated launchers 35.157.111[.]131 3","pattern":"[file:hashes.MD5 = '2a385fe7bed9899d77d05cb8e302d557']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--868afb65-0469-474f-8401-951782797bff","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 57b9c56ef97a7ada98257b23577bf5e3","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c3","pattern":"[file:hashes.MD5 = '57b9c56ef97a7ada98257b23577bf5e3']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3190eb06-046a-47e8-b3cc-0f0897f11eff","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 60a0f58001ea7be538cd42b651924cc7","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: 560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee","pattern":"[file:hashes.MD5 = '60a0f58001ea7be538cd42b651924cc7']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--4ccc5727-bbbc-4eac-a289-0aae3d622851","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 6b49f24d5d5b49127476bc385565f8b0","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: llation executable %TEMP%\\checkinternetconnection.bat MD5 : 6b49f24d5d5b49127476bc385565f8b0 BAT file used to confirm a working internet connection %TEM","pattern":"[file:hashes.MD5 = '6b49f24d5d5b49127476bc385565f8b0']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--d2073b48-670e-4b58-beb4-3e47b91d89b4","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 8da3fe3664d81226b0fb2a50a0537d4f","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: :\\Users\\Default\\Local Settings\\[RANDOM FILE NAME].exe MD5 : 8da3fe3664d81226b0fb2a50a0537d4f Copy of DCRAT and associated installation files 0.0.0.0 app","pattern":"[file:hashes.MD5 = '8da3fe3664d81226b0fb2a50a0537d4f']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--255260cf-0e9f-46fe-84b5-c21d78a92706","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: a15e280a3fd65dfaa243bbe2dbf45e97","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: Compromise (IOCs) Item Description Gta6installer.exe MD5 : a15e280a3fd65dfaa243bbe2dbf45e97 Initial installation executable %TEMP%\\checkinternetconnect","pattern":"[file:hashes.MD5 = 'a15e280a3fd65dfaa243bbe2dbf45e97']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--090fdca6-eabf-478e-86e3-abfdf614303a","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: b9648ec8cc806e7661aabcfc91dc836c","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: MP%\\gta6.exe %USERPROFILE%\\AppData\\Roaming\\svchost.exe MD5: b9648ec8cc806e7661aabcfc91dc836c Chaos ransomware binaries read_it.txt Ransomware note left","pattern":"[file:hashes.MD5 = 'b9648ec8cc806e7661aabcfc91dc836c']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--64d6496c-7ed3-404e-bd55-e94ab9e77d7c","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: dfdf5e5b78d2ec764c0e5641cf9a0d26","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: IP address that DCRAT connects to %TEMP%\\adminapp.exe MD5 : dfdf5e5b78d2ec764c0e5641cf9a0d26 Mercurial Grabber infostealer binary https://discord[.]com/","pattern":"[file:hashes.MD5 = 'dfdf5e5b78d2ec764c0e5641cf9a0d26']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c6eb200c-bd7c-4c3b-87a2-a7438dfb6554","created":"2026-09-09T14:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: ea991bc9334b36a6b958f564ee716776","description":"Seen in \"Grand Theft Auto VI hype leads to malware\" (Huntress). Context: 8001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associ","pattern":"[file:hashes.MD5 = 'ea991bc9334b36a6b958f564ee716776']","pattern_type":"stix","valid_from":"2026-09-09T14:00:00.000Z","labels":["auto-extracted","malware"],"confidence":30,"external_references":[{"source_name":"Huntress","url":"https://www.huntress.com/blog/fake-gta6-download-malware-analysis"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--723a79cc-8be7-495b-a6d4-58434ee0862e","created":"2026-09-09T00:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 528cd4e69ecfa5191adbcf6ef28667bf","description":"Seen in \"Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF\" (GreyNoise). Context: ute the campaign 45.158.196.75 Used to execute the campaign 528cd4e69ecfa5191adbcf6ef28667bf (lsa_read.exe) Rust LSA secret reader ce870a91e8d27e8f663f0","pattern":"[file:hashes.MD5 = '528cd4e69ecfa5191adbcf6ef28667bf']","pattern_type":"stix","valid_from":"2026-09-09T00:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GreyNoise","url":"https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--59402759-aab7-40ed-a440-b6e7c4de5013","created":"2026-09-09T00:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: 974decb9ff4c8f9ccb0937c96d513347","description":"Seen in \"Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF\" (GreyNoise). Context: f75d1d19 (lsa_collect_small.exe) Rust LSA bootkey collector 974decb9ff4c8f9ccb0937c96d513347 (certipy.exe) ADCS Abuse Tool Administrator17 Adversary cre","pattern":"[file:hashes.MD5 = '974decb9ff4c8f9ccb0937c96d513347']","pattern_type":"stix","valid_from":"2026-09-09T00:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GreyNoise","url":"https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--52aede76-13c8-446e-b854-35ebd9e95c3a","created":"2026-09-09T00:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: a6437ac3d6798090a218520985d36a3f","description":"Seen in \"Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF\" (GreyNoise). Context: 27e8f663f0687abc60b04 (save_hives.exe) Registry Hive Dumper a6437ac3d6798090a218520985d36a3f (collect_custom.exe) Rust custom collector fc92dfafa7aa741c","pattern":"[file:hashes.MD5 = 'a6437ac3d6798090a218520985d36a3f']","pattern_type":"stix","valid_from":"2026-09-09T00:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GreyNoise","url":"https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--3b332bb9-c1b5-4410-a4a1-bdef7c2ef74d","created":"2026-09-09T00:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: ce870a91e8d27e8f663f0687abc60b04","description":"Seen in \"Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF\" (GreyNoise). Context: fa5191adbcf6ef28667bf (lsa_read.exe) Rust LSA secret reader ce870a91e8d27e8f663f0687abc60b04 (save_hives.exe) Registry Hive Dumper a6437ac3d6798090a2185","pattern":"[file:hashes.MD5 = 'ce870a91e8d27e8f663f0687abc60b04']","pattern_type":"stix","valid_from":"2026-09-09T00:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GreyNoise","url":"https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c4d9c62d-47ea-4d4e-b421-ed0352b0622b","created":"2026-09-09T00:00:00.000Z","modified":"2026-09-15T22:16:05.172Z","created_by_ref":"identity--4082c209-6088-4b20-b0f0-0fa27033eb58","name":"md5: fc92dfafa7aa741c5f2b9cbcf75d1d19","description":"Seen in \"Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF\" (GreyNoise). Context: a218520985d36a3f (collect_custom.exe) Rust custom collector fc92dfafa7aa741c5f2b9cbcf75d1d19 (lsa_collect_small.exe) Rust LSA bootkey collector 974decb9","pattern":"[file:hashes.MD5 = 'fc92dfafa7aa741c5f2b9cbcf75d1d19']","pattern_type":"stix","valid_from":"2026-09-09T00:00:00.000Z","labels":["auto-extracted","threat-actor"],"confidence":30,"external_references":[{"source_name":"GreyNoise","url":"https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf"}]}]}