Grand Theft Auto VI hype leads to malware
AI summary · glm-5.3-flashSummaries by Vani AI
Fake GTA6 ISO downloads spread via SEO poisoning, torrents, and forums deliver NJRAT, DCRAT, an infostealer, and wiper ransomware.
Huntress analyzed a malicious ISO masquerading as a leaked Grand Theft Auto VI build; there is no official GTA6 demo or leaked playable copy. The fake gta6installer.exe shows a Russian 'license' message asking victims to email the attacker if the crack fails, then drops GTA6-branded files into %TEMP%. It installs multiple repurposed NJRAT copies (2023-era files) connecting to AWS-hosted IPs 35.157.111.131, 3.68.56.232, 3.67.15.169 and an ngrok tunnel, plus DCRAT communicating with a0700877.xsph.ru (141.8.197.42). The bundle also includes an infostealer and ransomware used as a wiper, in what appears to be an opportunistic, everything-at-once campaign.
Key facts
- ISOs are padded with junk data up to 100GB to mimic AAA game sizes.
- Installer displays a Russian message and directs 'License not found' errors to an attacker-controlled Gmail address.
- Three NJRAT copies create Windows Firewall rules and contact AWS IPs plus ngrok tunneling infrastructure.
- DCRAT installs as UserOOBEBroker.exe in C:\Users\Default\Local Settings and talks to a blocklisted xsph.ru domain.
- Distribution channels include SEO poisoning, gaming forums, torrent sites, and social media posts.
- ATT&CK
- T1204.002 Malicious FileT1056.001 KeyloggingT1113 Screen CaptureT1555.003 Credentials from Web BrowsersT1485 Data Destruction
- Vendors
- HuntressRockstar Games
- Products
- ScreenConnect
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | clck.ru | t file then launches Microsoft Edge and connects to https://clck[.]ru/34uJnp , where it confirms that it has an internet connec |
| domain | flow.lavasoft.com | le-analytics.l.google.com 0.0.0.0 static.hotjar.com 0.0.0.0 flow.lavasoft.com 0.0.0.0 telemetry.servers.getgo.com 0.0.0.0 telemetry.malwa |
| domain | ngrok.io | to secure tunneling services provided by ngrok at 7.tcp.eu.ngrok[.]io:12684 . Three more copies of NJRAT ( license.exe , rockst |
| domain | telemetry.servers.getgo.com | 0.0.0.0 static.hotjar.com 0.0.0.0 flow.lavasoft.com 0.0.0.0 telemetry.servers.getgo.com 0.0.0.0 telemetry.malwarebytes.com 0.0.0.0 ws.mcafee.com 0. |
| domain | xsph.ru | and then deletes itself. The RAT then connects to a0700877.xsph[.]ru ( 141.8.197[.]42 ). This domain has been on blocklists fo |
| ipv4 | 141.8.197.42 | letes itself. The RAT then connects to a0700877.xsph[.]ru ( 141.8.197[.]42 ). This domain has been on blocklists for several years, |
| ipv4 | 35.157.111.131 | ral IP addresses associated with AWS-hosted infrastructure: 35.157.111[.]131 3.68.56[.]232 3.67.15[.]169 They also connect to secure t |
| ipv4 | 3.67.15.169 | h AWS-hosted infrastructure: 35.157.111[.]131 3.68.56[.]232 3.67.15[.]169 They also connect to secure tunneling services provided b |
| ipv4 | 3.68.56.232 | associated with AWS-hosted infrastructure: 35.157.111[.]131 3.68.56[.]232 3.67.15[.]169 They also connect to secure tunneling servi |
| md5 | 0e39e8d7b641bcda4376ebbfeff7b12e | 18d1498bc3d904899d Yandex web browser %TEMP%\find.vbs MD5 : 0e39e8d7b641bcda4376ebbfeff7b12e Script that displays a "license not found" message |
| md5 | 15eca4a3f7350423cf4db0b4c30d1968 | 6ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e3 |
| md5 | 1ec9eff863dc4418d1498bc3d904899d | ansomware-encrypted files %TEMP%\YandexPackLoader.exe MD5 : 1ec9eff863dc4418d1498bc3d904899d Yandex web browser %TEMP%\find.vbs MD5 : 0e39e8d7b641bcda43 |
| md5 | 2a0834560ed3770fc33d7a42f8229722 | ckstargamescrashfixer.exe %TEMP%\rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651 |
| md5 | 2a385fe7bed9899d77d05cb8e302d557 | a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associated launchers 35.157.111[.]131 3 |
| md5 | 57b9c56ef97a7ada98257b23577bf5e3 | rockstarservices.exe MD5s: 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c3 |
| md5 | 60a0f58001ea7be538cd42b651924cc7 | 560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee |
| md5 | 6b49f24d5d5b49127476bc385565f8b0 | llation executable %TEMP%\checkinternetconnection.bat MD5 : 6b49f24d5d5b49127476bc385565f8b0 BAT file used to confirm a working internet connection %TEM |
| md5 | 8da3fe3664d81226b0fb2a50a0537d4f | :\Users\Default\Local Settings\[RANDOM FILE NAME].exe MD5 : 8da3fe3664d81226b0fb2a50a0537d4f Copy of DCRAT and associated installation files 0.0.0.0 app |
| md5 | a15e280a3fd65dfaa243bbe2dbf45e97 | Compromise (IOCs) Item Description Gta6installer.exe MD5 : a15e280a3fd65dfaa243bbe2dbf45e97 Initial installation executable %TEMP%\checkinternetconnect |
| md5 | b9648ec8cc806e7661aabcfc91dc836c | MP%\gta6.exe %USERPROFILE%\AppData\Roaming\svchost.exe MD5: b9648ec8cc806e7661aabcfc91dc836c Chaos ransomware binaries read_it.txt Ransomware note left |
| md5 | dfdf5e5b78d2ec764c0e5641cf9a0d26 | IP address that DCRAT connects to %TEMP%\adminapp.exe MD5 : dfdf5e5b78d2ec764c0e5641cf9a0d26 Mercurial Grabber infostealer binary https://discord[.]com/ |
| md5 | ea991bc9334b36a6b958f564ee716776 | 8001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 Ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 Copies of NJRAT and associ |
From the original article
8 min read at huntress.comThreat actors are exploiting GTA6 hype with fake leaked downloads spread via SEO poisoning, packed with RATs, infostealers, and wiper ransomware. Here’s what Huntress found.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.