Malware-laced South Park torrent targets Sonarr users, steals credentials

A fake South Park episode uploaded to public torrent trackers is actually a credential-stealing malware that hides its payload in 887 MB of junk data. The malware, which targets Sonarr users, uses ChaCha20 encryption and a YouTube channel as a dead drop for its command server.

A warning on a NAS dashboard led a user to discover a new malware campaign targeting Sonarr users. The fake episode, named South Park S29E03 1080p WEB H264-MeGusta.exe , appeared on public trackers with thousands of seeders, but the file was actually a credential stealer wrapped in 887 MB of junk data.

The user, who detailed the analysis in a blog post, found the file after Sonarr kept failing to import it. The download completed instantly with zero bytes transferred, a red flag that the file was malicious. After blocklisting it, the user downloaded it again to analyze the payload.

The payload: a classic stealer with modern obfuscation

The executable is a real PE file, x64 GUI, with the actual program only 118 KB. The remaining 886 MB is random data appended to evade antivirus scanners that give up on large files. The version info claims it's from "Freeware Developers," but the code tells a different story.

Inside, the malware uses a global XOR obfuscation routine that does nothing but clutter decompiler output. After stripping that, the logic is simple: it reads its own file, decrypts a hidden payload using a key stored in the last 64 bytes, maps it as a PE in memory, and jumps to it. Nothing touches disk.

The footer contains a 32-byte key, a ChaCha20 nonce, and payload size, all XORed with a mask. The key is literally in the file, so a few lines of Python can decrypt the payload without running the malware. The payload is a second PE, 929 KB, written in C++20 with zlib bundled.

What the stealer targets

The second-stage malware is a credential stealer that targets a wide range of applications:

Browsers : Chrome, Edge, Brave, Opera, Vivaldi, Firefox – passwords, cookies, autofill, including Chrome's app-bound encryption

Crypto wallets : Exodus, Electrum, Atomic, Guarda, Coinomi, Ledger Live, Trezor Suite, Wasabi, Sparrow, Monero, Zcash, Armory, plus browser extension wallets

Password managers : KeePass, KeePassXC, Bitwarden, 1Password, NordPass, RoboForm, Windows Credential Manager

Accounts : Telegram, Discord tokens, Steam, Roblox cookies, Minecraft accounts, Authy

Dev tools : .ssh, .aws, .azure, gcloud, .kube, .docker

Remote access : AnyDesk, TeamViewer, WinSCP, FileZilla, mRemoteNG, RDCMan

Other : Outlook, Thunderbird, VPN configs, OBS settings, Sticky Notes, and desktop documents

Everything is zipped and exfiltrated to a remote server.

Command server hidden in plain sight

Instead of a hardcoded server address, the malware decrypts a YouTube channel URL and a GitHub gist. The YouTube channel, "bubblegym," was created Sept. 14, 2026, and contains a base64-encoded string that, when XORed with a key, reveals the actual server: beenetprotect[dot]com/lgz/gdata . That address is also hardcoded in the binary as a fallback, defeating the purpose of the dead drop.

The domain was registered the same day as the YouTube channel, using Cloudflare Registrar. The malware was built Oct. 6 and uploaded to torrents Oct. 8.

Protecting your *arr stack

If you run Sonarr or Radarr with public indexers, this will eventually hit you. Sonarr can't execute an exe, so the risk is someone on your network double-clicking it. To mitigate:

In qBittorrent, add *.exe , *.scr , *.lnk , *.bat , *.cmd to "Excluded file names" to refuse downloading them

In Sonarr/Radarr, blocklist the release and remove it from the client

In Prowlarr, demote or drop trackers that serve this junk

The malware author spent considerable effort on obfuscation, but the key was left in the file, and the server address was hardcoded anyway. A simple Python script can decrypt the payload, and the stealer's targets are broad but predictable. The lesson: stay vigilant, and never run executables from torrents.

Source : thereallo.dev