Is GTA6_LUCIA_NACKED.mp4.rar safe? No, we rate this exact file malicious.

Programs the file ran, with their command lines.

• GTA6_LUCIA_NACKED.mp4.exe"C:\Users\<USER>\AppData\Local\Temp\GTA6_LUCIA_NACKED.mp4/GTA6_LUCIA_NACKED.mp4.exe"
• cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\<USER>\AppData\Local\Temp\RarSFX0\stub.bat" "
• unarchiver.exe"C:\Windows\System32\unarchiver.exe" "C:\Users\user\Desktop\GTA6_LUCIA_NACKED.mp4.rar"
• 7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\bb3odkto.1tp" "C:\Users\user\Desktop\GTA6_LUCIA_NACKED.mp4.rar"
• cmd.exeC:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\bb3odkto.1tp\GTA6_LUCIA_NACKED.mp4\GTA6_LUCIA_NACKED.mp4.exe"
• GTA6_LUCIA_NACKED.mp4.exeC:\Users\user\AppData\Local\Temp\bb3odkto.1tp\GTA6_LUCIA_NACKED.mp4\GTA6_LUCIA_NACKED.mp4.exe

2 hosts, listed as 1 domain, 1 address. Links show the host and path only.

• Domainduckyduckserver.duckdns.org
• IP address88.166.139.89

Files the file created, changed or deleted.

• WrittenC:\Users\<USER>\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_50078
• WrittenC:\Users\<USER>\AppData\Local\Temp\RarSFX0\stub.bat
• WrittenC:\Users\<USER>\AppData\Local\Temp\RarSFX0\preview.png
• WrittenC:\Users\<USER>\AppData\Local\Temp\RarSFX0\WinUpdate_Helper.exe
• WrittenC:\Users\user\AppData\Local\Temp\bb3odkto.1tp
• WrittenC:\Users\user\AppData\Local\Temp\bb3odkto.1tp\GTA6_LUCIA_NACKED.mp4

Named locks a program uses so only one copy runs; malware families often reuse them.

• Global\SyncRootManager

The analysis machine's own processes and connections, recorded in every run.

• VM processservices.exeC:\Windows\system32\services.exe
• VM processDllHost.exeC:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
• VM processExplorer.EXEC:\Windows\Explorer.EXE
• VM processconhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1