Stealing more than the spotlight. [Research Saturday]

Matt Poto

Yeah, so I following social media, followed a lot of the leaks that were happening around Grand Theft Auto 6 a few weeks back and it came to really my attention that the leaker was giving out a an ISO for people to use for I believe it was $60 in crypto.

Matt Poto

As far as I'm aware, they are all scams or malware.

Matt Poto

Well, games these days are really, really large, often over 100 gigabytesyou really want the victim to believe they're actually downloading Grand Theft Auto until the moment that they get you.

Matt Poto

Yeah, so, what I had found when I had found an example was the installer claimed to be GTA 6. It said it, it had, this one I specifically found had Russian language on it. And it said the GTA 6 installer, it's an honor release game, and that if you receive an error that says license not found, to email them at their your Gmail, and they will update it so it works. Running this installer though, dropped multiple remote access Trojans, it dropped an info stealer, and in my case, it also dropped a piece of ransomware that was just basically being a wiper to destroy your computer.

Matt Poto

Yeah, so, there was two distinct varieties. There is DC rat and NJ rat. These are both commonly known pieces of malware, commonly known rats.

Matt Poto

Mercurial Grabber specifically has steals Roblox and Minecraft session data, Discord tokens, stuff for your Google Chrome browser, and it gets any system information it can.

Matt Poto

Which I think kind of talks or talks to the kind of people they were targeting with distributing this specific malware.

Matt Poto

Sure. So, Chaos is again, another known ransomware variant. This one specifically, it would when you install it, it would find files that were smaller than 200 megabytes and it would create a password and it would encrypt them with that password, each file having its own unique password. Anything over 200 megabytes was written with just random data, so that it would effectively destroy them.

Matt Poto

And then they put up a ransom note that just says your files have been encrypted and we don't want anything, your files have been destroyed forever.

Dave Bittner

the victim gets exactly the license not found error that they were primed to expect.

Matt Poto

You know, I think it's important to try to maintain some sort of stealth or persistence so that the threat actor can stay on the computer as long as they can.

Matt Poto

It however, does not make this any less dangerous because while one threat actor may package commercial malware, commodity malware together, another threat actor that's more sophisticated will find ways to get around Defender and still gain persistent access to your computer.

Matt Poto

my guidance is start fresh. Take your computer and completely wipe it with a fresh install of whatever operating system you use, in this case Windows.

Matt Poto

Yeah, I mean, it's just very opportunistic. You, if you want to grab as many, as much information as you can, as many logins as you can, maybe you'll get lucky, you get someone's bank account, lucky is the wrong word, but if you get someone's bank account information it's it's an attempt to just get as much data as they can on you.

Matt Poto

You know, I mean, it all the same, I think trying to find trying to be careful about what you're downloading. I think we might still see more attempts at getting people to install GTA 6 early.