Fake GTA 6 download delivers malware-packed bundle to impatient gamers
Huntress found malware disguised as a leaked GTA 6 download bundling NJRAT, DCRAT, an infostealer, and Chaos ransomware used as a wiper.
Huntress analyzed a fake Grand Theft Auto VI ISO whose gta6installer.exe displays a fake 'License not found' error while silently installing payloads. The bundle includes NJRAT and DCRAT remote access trojans, the Mercurial Grabber infostealer, and a Chaos ransomware variant used destructively as a wiper, plus a Yandex Browser drop. The Chaos variant encrypts files up to 200MB, overwrites larger ones, deletes shadow copies, and disables recovery, with no ransom actually demanded. Most components are old malware dating to 2023 and are detected by up-to-date Windows Defender.
- Fake gta6installer.exe shows a 'License not found' error while silently installing payloads.
- Bundle includes NJRAT, DCRAT, Mercurial Grabber, and a Chaos ransomware variant.
- Chaos encrypts files up to 200MB and destroys larger ones, deleting shadow copies.
- Components date to 2023; up-to-date Windows Defender detects them.
- ATT&CK
- T1204.002 Malicious FileT1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1562.001 Impair Defenses: Disable or Modify ToolsT1056.001 Keylogging
- Vendors
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | clck.ru | t file then launches Microsoft Edge and connects to https://clck[.]ru/34uJnp, where it confirms that it has an internet connect |
From the original article
3 min read at helpnetsecurity.com
Grand Theft Auto VI (GTA 6) is still three months from release, but cybercriminals are not waiting for the launch date. Security firm Huntress found malware disguised as a leaked copy of the game, aimed at fans hoping to get their hands on it early. The sample Huntress pulled apart contained several different malware components.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.