Grand Theft Auto VI hype leads to malware

What it is

A specific fake-GTA6 ISO sample analyzed by Huntress that bundles a Russian-language "crack" installer (gta6installer.exe, ironically bearing a GTA5 icon) dropping six-plus NJRAT copies, a DCRAT implant, the Mercurial Grabber infostealer, and Chaos ransomware run as a destructive wiper. This document carries the concrete file names, IOCs, and execution chain the summary references but does not list.

How it works

The installer writes GTA6-branded binaries to %TEMP%. checkinternetconnection.bat opens Edge to https://clck[.]ru/34uJnp as a connectivity check before unpacking. Then, by dropper:

• licensechecker.exe→any.ran.exe, rockstar.exe→svchost.exe, steam.exe→abc.exe are the active NJRAT instances (three more — license.exe, rockstargamescrashfixer.exe, rockstarservices.exe — are dropped but dormant).
• rockstargames.exe drops %TEMP%\P3usMXh1h4.bat, which sets the NTP server to local, installs DCRAT as a random name (observed UserOOBEBroker.exe) under C:\Users\Default\Local Settings\, then deletes itself. It also edits the hosts file to sinkhole telemetry/AV-reporting domains.
• adminapp.exe is Mercurial Grabber (Roblox/Minecraft/Discord tokens, Chrome creds, Windows keys), exfiltrating via Discord webhook.
• gta6.exe drops Chaos wiper as %USERPROFILE%\AppData\Roaming\svchost.exe — only if the user is admin. It deletes shadow copies, disables boot recovery, sets a SpongeBob "ASHA HACKER TEAM" wallpaper, AES-encrypts files ≤200MB with a random 4-char extension, and overwrites files >200MB with random data (unrecoverable). Ransom note read_it.txt names no payment method — it is a wiper, not extortion.

Finally find.vbs shows a "license not found" popup — the exact error the installer pre-warned about — as cover.

IOCs

• NJRAT C2: 35.157.111[.]131, 3.68.56[.]232, 3.67.15[.]169; ngrok tunnel 7.tcp.eu.ngrok[.]io:12684
• DCRAT C2: a0700877.xsph[.]ru (141.8.197[.]42) — long on blocklists
• Grabber webhook: https://discord[.]com/api/webhooks/995445114254139543/NmpxQmuBCD6sm3UkVvupGtx-Y0M_A86oJHp00O-l8F4jakfVhqFXzMBoy1uBDdj2rBLc
• Connectivity beacon: https://clck[.]ru/34uJnp

What to do

Nothing here is novel — malware dates to 2023 and current Windows Defender detects every component. If infected: disconnect from the network, reset all passwords, enable 2FA, and fully reimage (the wiper makes selective cleanup pointless).

Caveats

This is one sample; other GTA6-ISO writeups describe different functionality. The contact email drew no response. The Yandex Browser install (YandexPackLoader.exe) is unexplained — Huntress speculates only that the Russian text and browser suggest an eastern-European/Russian original target.