Fake GTA 6 Installer Deploys RATs, an Infostealer, and Destructive Ransomware
Summary
Huntress analyzed a fake GTA 6 ISO that installs NJRAT, DCRAT, Mercurial Grabber, and Chaos ransomware used as a wiper. Researchers say updated Windows Defender should detect it.
Key points
- The fake ISO presents a GTA-branded installer that displays a plausible installation error while deploying malware in the background.
- The bundle includes NJRAT and DCRAT, which enable remote access and theft or monitoring of user and system data.
- Mercurial Grabber collects Discord tokens, browser credentials and cookies, game-session data, Windows product keys, and screenshots, then sends them through a Discord webhook.
- The Chaos ransomware variant encrypts smaller files, overwrites larger ones, deletes shadow copies, and disables Windows recovery options; Huntress says it appears to be used as a wiper, not for ransom.
- Russian-language messages and the included Yandex Browser suggest Russian-speaking users may be among the intended targets, according to Huntress.
- Huntress says the malware is several years old and an up-to-date Windows Defender should detect and stop it.
Article Details
- Attack Vectors
- A fake GTA 6 ISO masquerades as a leaked game installer and uses a bundled installer to conceal malware installation in the background.
- The installer displays a Russian-language error message to make the failed game launch appear plausible while a script installs the payload.
- A batch file launches Microsoft Edge and visits a URL to check internet connectivity before unpacking and installing malware.
- Defensive Notes
- Huntress said an up-to-date Windows Defender should detect and block the malware.
- Avoid downloading cracked or pirated software, particularly purported releases of games that are not yet available.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//clck[.]ru/34uJnp | URL contacted by the malware's checkinternetconnection.bat file to verify internet connectivity before installing its components. |
MITRE ATT&CK
T1036 · MasqueradingThe fake GTA 6 installer and payload files use GTA6 branding to avoid suspicion.T1056.001 · KeyloggingNJRAT provides keystroke-logging capability.T1059.003 · Windows Command ShellThe checkinternetconnection.bat file launches Microsoft Edge and initiates the connectivity check before malware installation.T1113 · Screen CaptureNJRAT and DCRAT can capture screenshots, and Mercurial Grabber also collects screenshots.T1204.002 · Malicious FileVictims are lured into running a fake leaked GTA 6 installer.T1529 · System Shutdown/RebootChaos encrypts or destroys files, deletes shadow-copy backups, and disables Windows recovery options.T1539 · Steal Web Session CookieMercurial Grabber collects browser cookies.T1547.001 · Registry Run Keys / Startup FolderDCRAT rewrites the Windows hosts file to block antivirus telemetry from reaching security vendors.T1555 · Credentials from Password StoresNJRAT can access cryptocurrency wallet details.T1555.003 · Credentials from Web BrowsersNJRAT can steal browser credentials, and Mercurial Grabber collects Chrome passwords and cookies.
Malware
Vendors
Products
Grand Theft Auto VIGrand Theft Auto VI (GTA 6) is still three months from release, but cybercriminals are not waiting for the launch date.Microsoft Edge“The checkinternetconnection.bat file then launches Microsoft Edge and connects to https://clck[.]ru/34uJnp, where it confirms that it has an internet connection before proceeding to unpack and install the variousWindows DefenderHuntress found that the fake installer hides the payload while suggesting Russian-speaking users may be among the intended targets, and Windows Defender should detect the threat.Yandex BrowserFinally, the installer drops a copy of Yandex Browser, for no apparent reason Huntress could pin down.