GTA 6 Trailer - Screenshots Image © RockstarGTA 6 Trailer - Screenshots (Image © Rockstar)

The widely circulated archive named grand.theft.auto.6.cyberleek.build.v1.277.0.lucia.repack.iso has a file size of approximately 113 GB. However, a technical analysis shows that the actual malicious payload is only about 50 KB. The remaining space is filled with junk data and zeros to artificially inflate the file size, thereby creating a false impression of legitimacy for users who assume that a modern AAA game requires a lot of storage space. The contents of the ISO file are minimal and typically consist of a few images and executable files, such as SetupGTAVI.exe, as well as various .doi data files.

Malware Behavior and Impact on the System

When executed, the software does not install a game but instead performs several high-risk actions to compromise the host system:

  • Security bypass: The malware uses PowerShell commands, specifically Add-MpPreference -ExclusionPath %SystemDrive%\, to add the entire C: drive to Windows Defender’s whitelist. This prevents the antivirus program from scanning the primary system partition for additional threats.
  • Disabling security measures: The program uses the taskkill -f command to forcibly terminate running security software and antivirus processes.
  • Data Access: Once the protection layers have been bypassed, the malware can spread across the drive, manipulate files, or exfiltrate sensitive user data without triggering any system warnings.

An independent analysis using the Anyrun online sandbox has confirmed the file’s suspicious behavior. Tests suggest that the executable file is specifically designed to neutralize Windows security settings before deploying its malicious payload. Security experts are warning users against downloading alleged leaks of the game, as cybercriminals are exploiting current trends and the anticipation surrounding the title to spread malware.