Beware of a crypto mining malware known as Crackonosh in free GTA 5 torrents

Anybody who has downloaded a free GTA 5 copy from unofficial sources may have also downloaded Crackonosh unwillingly.

As delightful as a free GTA 5 torrent sounds, the idea of having Crackonosh, a crypto mining malware, installed with it, isn't as exciting to some gamers. However, Crackonosh isn't just limited to GTA 5 torrents; all sorts of popular games are being bundled with it on various questionable sites.

Although not every free copy of GTA 5 comes with Crackonosh, players should be warned about it ahead of time all the same. If the download source is shady, then these players should know that malware tends to come with deals like that more often than not.

---

---

Free GTA 5 torrents and the crypto mining malware Crackonosh

Countries and how they have been affected by Crackonosh (Image via Avast Threat Labs)

According to Avast, Crackonosh has hit over 220,000 computers since December 2020, meaning that the number has likely grown since then. It isn't a normal type of crypto mining software that aims to help its user; it's a piece of malware that will quietly use the computer's processing power to make money for somebody else.

Avast has stated that this malware has generated over $2,000,000 since June 2018, which might not seem like much money a player could be missing out on, but its other unintended side effects make this piece of malware undesirable to have.

What does Crackonosh do?

Some GTA 5 torrents may include Crackonosh (Image via Rockstar Games)

Crackonosh is usually bundled with a popular game like GTA 5, but it doesn't have to be just GTA 5. Other torrents for games like the Sims 4 (and its DLC), Pro Evolution Soccer 2018, Far Cry 5, and NBA 2K19 are all known to have some questionable sources out there.

If a player did download a free copy of GTA 5 from a less than reputable site, then they might have Crackonosh. This piece of malware drops three notable files (winrmsrv.exe, winscomrssrv.dll, and winlogui.exe), and it disables Windows Defender and updates to ensure that everything goes according to plan.

It would install a coinminer known as XMRing, which is a legitimate piece of crypto mining software. However, it would still use the computer's resources, and the player wouldn't see a penny for all of this effort.

The number of people hit by Crackonosh every day (Image via Avast Threat Labs)

Avast has identified that there are many different versions of Crackonosh from 2018 to 2020, which does include a popular game like GTA 5 being one variant. Regardless if it's bundled with GTA 5 or another game, Crackonosh works largely the same.

This piece of malware will disable and try to delete Windows Defender and whatever Antivirus software the player might have. It does this by abusing Windows Safe Mode to get rid of these critical defense measures, which makes its discovery this past week quite fortunate. It will even try to evade detection (going as far as delaying its execution when a computer is booted).

Many Avast users were reporting that their antivirus was missing, which led to Avast looking at the reports before detailing all of their findings here. As many gamers are looking for popular games like GTA 5 for free, it's not surprising to see some copies of it associated with more nefarious intentions.