Hackers Use Fake GTA 6 Downloads to Deploy RATs, Infostealers and Data-Wiping Malware
Huntress tracked fake GTA 6 downloads distributing NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware used as a wiper against gamers.
Cybercriminals are pushing fake Grand Theft Auto VI downloads through poisoned search results, gaming forums, torrent sites, and social media, targeting players seeking a leaked build before release. Huntress analyzed a sample bundling NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware in one package; fake ISO files exceed 100GB largely with junk data, and Russian-language prompts suggest the operators target Russian-speaking gamers. Chaos ransomware acts as a wiper, overwriting files larger than 200MB with random data, deleting shadow copies for admin users, and disabling recovery options rather than offering genuine ransom payment paths.
- Fake installers show a license error while malware runs in background
- NJRAT and DCRAT provide keylogging, screenshots, webcam, and clipboard access
- Mercurial Grabber steals passwords, cookies, chat tokens, and product keys
- Chaos ransomware overwrites files over 200MB, acting as a wiper
- Hosts file changes block telemetry and security-reporting services
- ATT&CK
- T1189 Drive-by CompromiseT1204.002 Malicious FileT1056.001 KeyloggingT1486 Data Encrypted for ImpactT1490 Inhibit System Recovery
- Vendors
- HuntressRockstar Games
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | flow.lavasoft.com | le-analytics.l.google.com 0.0.0.0 static.hotjar.com 0.0.0.0 flow.lavasoft.com 0.0.0.0 telemetry.servers.getgo.com 0.0.0.0 telemetry.malwa |
| domain | mobile-service.segment.com | .com 0.0.0.0 cdn.segment.com 0.0.0.0 api.segment.io 0.0.0.0 mobile-service.segment.com Entries added to the Windows hosts file by DCRAT Domain / I |
| domain | ngrok.io | 69 Infrastructure contacted by NJRAT Domain / Port 7.tcp.eu.ngrok[.]io:12684 ngrok endpoint contacted by NJRAT File names / MD5 |
| domain | telemetry.servers.getgo.com | 0.0.0.0 static.hotjar.com 0.0.0.0 flow.lavasoft.com 0.0.0.0 telemetry.servers.getgo.com 0.0.0.0 telemetry.malwarebytes.com 0.0.0.0 ws.mcafee.com 0. |
| domain | xsph.ru | he Windows hosts file by DCRAT Domain / IP address a0700877.xsph[.]ru 141.8.197[.]42 DCRAT command-and-control infrastructure F |
| ipv4 | 141.8.197.42 | hosts file by DCRAT Domain / IP address a0700877.xsph[.]ru 141.8.197[.]42 DCRAT command-and-control infrastructure File name / MD5 |
| ipv4 | 35.157.111.131 | e302d557 NJRAT copies and associated launchers IP addresses 35.157.111[.]131 3.68.56[.]232 3.67.15[.]169 Infrastructure contacted by N |
| ipv4 | 3.67.15.169 | iated launchers IP addresses 35.157.111[.]131 3.68.56[.]232 3.67.15[.]169 Infrastructure contacted by NJRAT Domain / Port 7.tcp.eu. |
| ipv4 | 3.68.56.232 | pies and associated launchers IP addresses 35.157.111[.]131 3.68.56[.]232 3.67.15[.]169 Infrastructure contacted by NJRAT Domain / |
| md5 | 0e39e8d7b641bcda4376ebbfeff7b12e | cluded in the malicious ISO File name / MD5 %TEMP%\find.vbs 0e39e8d7b641bcda4376ebbfeff7b12e Script that displays the fake “license not found” message E |
| md5 | 15eca4a3f7350423cf4db0b4c30d1968 | 6ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e3 |
| md5 | 1ec9eff863dc4418d1498bc3d904899d | haos ransomware File name / MD5 %TEMP%\YandexPackLoader.exe 1ec9eff863dc4418d1498bc3d904899d Browser installer included in the malicious ISO File name / |
| md5 | 2a0834560ed3770fc33d7a42f8229722 | %\rockstargamescrashfixer.exe , %TEMP%\rockstarservices.exe 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651 |
| md5 | 2a385fe7bed9899d77d05cb8e302d557 | a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 NJRAT copies and associated launchers IP addresses 35.157.1 |
| md5 | 57b9c56ef97a7ada98257b23577bf5e3 | TEMP%\rockstarservices.exe 2a0834560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c3 |
| md5 | 60a0f58001ea7be538cd42b651924cc7 | 560ed3770fc33d7a42f8229722 57b9c56ef97a7ada98257b23577bf5e3 60a0f58001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee |
| md5 | 6b49f24d5d5b49127476bc385565f8b0 | ecutable File name / MD5 %TEMP%\checkinternetconnection.bat 6b49f24d5d5b49127476bc385565f8b0 Batch file used to confirm internet connectivity File names |
| md5 | 8da3fe3664d81226b0fb2a50a0537d4f | at , C:\Users\Default\Local Settings\[RANDOM FILE NAME].exe 8da3fe3664d81226b0fb2a50a0537d4f DCRAT installer components and binary Hosts-file entries 0. |
| md5 | a15e280a3fd65dfaa243bbe2dbf45e97 | ype Indicator Description File name / MD5 Gta6installer.exe a15e280a3fd65dfaa243bbe2dbf45e97 Initial fake installation executable File name / MD5 %TEMP% |
| md5 | b9648ec8cc806e7661aabcfc91dc836c | %TEMP%\gta6.exe , %USERPROFILE%\AppData\Roaming\svchost.exe b9648ec8cc806e7661aabcfc91dc836c Chaos ransomware binaries File name read_it.txt Note droppe |
| md5 | dfdf5e5b78d2ec764c0e5641cf9a0d26 | -control infrastructure File name / MD5 %TEMP%\adminapp.exe dfdf5e5b78d2ec764c0e5641cf9a0d26 Mercurial Grabber infostealer binary URL https://discord[.] |
| md5 | ea991bc9334b36a6b958f564ee716776 | 8001ea7be538cd42b651924cc7 15eca4a3f7350423cf4db0b4c30d1968 ea991bc9334b36a6b958f564ee716776 2a385fe7bed9899d77d05cb8e302d557 NJRAT copies and associate |
From the original article
5 min read at cybersecuritynews.com
Cybercriminals are exploiting intense interest in Grand Theft Auto VI by pushing fake game downloads that install several types of malware instead of a playable game. The campaign targets people looking for an early build, leaked copy, or unofficial demo before the title’s release. The malicious downloads are distributed through poisoned search results, gaming forums, […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.