55
30
30
30
55
55
30
30
Grand Theft Auto VI hype leads to malware
Fake GTA6 ISO downloads spread via SEO poisoning, torrents, and forums deliver NJRAT, DCRAT, an infostealer, and wiper ransomware.
Huntress analyzed a malicious ISO masquerading as a leaked Grand Theft Auto VI build; there is no official GTA6 demo or leaked playable copy. The fake gta6installer.exe shows a Russian 'license' message asking victims to email the attacker if the crack fails, then drops GTA6-branded files into %TEMP%. It installs multiple repurposed NJRAT copies (2023-era files) connecting to AWS-hosted IPs 35.157.111.131, 3.68.56.232, 3.67.15.169 and an ngrok tunnel, plus DCRAT communicating with a0700877.xsph.ru (141.8.197.42). The bundle also includes an infostealer and ransomware used as a wiper, in what appears to be an opportunistic, everything-at-once campaign.
45
30
55
60
30
55
42
60
42
30
30
42
Upatre Continued to Evolve with new Anti
Unit 42 analyzes an undocumented Upatre downloader variant with VM detection via process hashing, packed code, disabled Windows defenses and Namecoin .bit C2 domains.
Unit 42 analyzed an Upatre downloader variant compiled in December 2016 that went largely undetected by automated systems, featuring heavy code flow obscuration, on-demand decryption of network communications, and novel virtual machine detection. The sample enumerates running processes, computes CRC32 hashes XORed with a hard-coded key, and sleeps if analysis-related processes such as vmtoolsd.exe or python.exe are found. It masquerades with Google Chrome icons, disables Windows Defender, Firewall and other security services, injects code into msiexec.exe, and resolves .bit Namecoin domains like bookreader[.]bit via hardcoded OpenNIC DNS servers over TCP.
28
60
30
47
30
60
60
42
30