Fake GTA VI Downloads Deliver RATs, an Infostealer and Destructive Malware

Sep 9, 2026 · Original article ↗

Summary

Huntress analyzed a fake GTA VI ISO distributed through search results, forums, social media, and torrents. It installs multiple RATs, an infostealer, and ransomware used as a wiper, while displaying a fake license error.

Key points

The malware is distributed as a purported leaked GTA VI ISO, promoted through SEO poisoning, gaming forums, social media, and torrent sites.
The ISO’s fake installer deploys several NJRAT copies, DCRAT, the Mercurial Grabber infostealer, and Chaos ransomware.
The RATs enable remote control and data theft; the infostealer targets browser credentials, Discord tokens, gaming data, and other system information.
The ransomware disables recovery options, encrypts smaller files, and overwrites files larger than 200 MB, functioning as a wiper rather than a ransom operation.
A fake “license not found” message is displayed to make users think the game failed to install while malware runs in the background.
Huntress says updated Windows Defender can detect the analyzed malware; for an infected system, it recommends disconnecting from the network, resetting passwords, enabling 2FA, and reimaging the system.

Article Details

Attack Vectors: SEO-poisoned search results, gaming forums, social media posts, and torrenting sites distributed ISOs masquerading as leaked GTA6 downloads.
Executing the fake installer unpacked and installed multiple RATs, an infostealer, and ransomware used as a wiper.
The infostealer sent stolen information through a Discord webhook.
Defensive Notes: The article reports that an up-to-date Windows Defender can detect and stop the malware.
For a system where the malware was installed, the article recommends disconnecting it from the network, resetting passwords, enabling 2FA, and completely reimaging the system.
Avoid downloading cracked or pirated software, particularly unreleased games.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`a0700877[.]xsph[.]ru`	Domain to which DCRAT connects; the article says it is listed as known malicious infrastructure.
HOSTNAME	`7[.]tcp[.]eu[.]ngrok[.]io`	Ngrok tunneling hostname used by NJRAT; the article gives port 12684.
IPV4	`141[.]8[.]197[.]42`	IP address associated with the DCRAT connection to a0700877.xsph[.]ru.
IPV4	`3[.]67[.]15[.]169`	IP address to which NJRAT instances connect.
IPV4	`3[.]68[.]56[.]232`	IP address to which NJRAT instances connect.
IPV4	`35[.]157[.]111[.]131`	IP address to which NJRAT instances connect.
MD5	`0e39e8d7b641bcda4376ebbfeff7b12e`	Hash of the script that displays a deceptive license-not-found message after the malware installation.
MD5	`15eca4a3f7350423cf4db0b4c30d1968`	Hash listed for a copy of NJRAT or an associated launcher in the fake game installation.
MD5	`2a0834560ed3770fc33d7a42f8229722`	Hash listed for a copy of NJRAT or an associated launcher in the fake game installation.
MD5	`2a385fe7bed9899d77d05cb8e302d557`	Hash listed for a copy of NJRAT or an associated launcher in the fake game installation.
MD5	`57b9c56ef97a7ada98257b23577bf5e3`	Hash listed for a copy of NJRAT or an associated launcher in the fake game installation.
MD5	`60a0f58001ea7be538cd42b651924cc7`	Hash listed for a copy of NJRAT or an associated launcher in the fake game installation.
MD5	`6b49f24d5d5b49127476bc385565f8b0`	Hash of the batch file used by the installer to check internet connectivity before unpacking malware.
MD5	`8da3fe3664d81226b0fb2a50a0537d4f`	Hash of the DCRAT copy or associated installation files.
MD5	`a15e280a3fd65dfaa243bbe2dbf45e97`	Hash of the fake GTA6 initial installation executable.
MD5	`b9648ec8cc806e7661aabcfc91dc836c`	Hash of the Chaos ransomware binaries used as a wiper.
MD5	`dfdf5e5b78d2ec764c0e5641cf9a0d26`	Hash of the Mercurial Grabber infostealer binary.
MD5	`ea991bc9334b36a6b958f564ee716776`	Hash listed for a copy of NJRAT or an associated launcher in the fake game installation.
URL	`hxxps[:]//clck[.]ru/34uJnp`	URL contacted by the malicious batch file during installation to check internet connectivity.
URL	`hxxps[:]//discord[.]com/api/webhooks/995445114254139543/NmpxQmuBCD6sm3UkVvupGtx-Y0M_A86oJHp00O-l8F4jakfVhqFXzMBoy1uBDdj2rBLc`	Discord webhook URL used by Mercurial Grabber to send stolen information.