The story of how someone thought they downloaded a video of a popular anime, but it ...

This article explains the discovery process, detailed technical analysis, and recommended countermeasures based on a case where a Sonarr user encountered malware in the form of an executable file (.exe) uploaded to a torrent site. Someone on Torrent Sites Kept Fucking With My Sonarr

The file in question was malware provided as a standalone executable file, unlike the typical fake files or bundles with 'codec installers' often seen. Although qBittorrent immediately indicated that the download was complete after downloading, no actual writing to disk occurred, suggesting the malware may have a mechanism to avoid writing to disk. The malware itself was a mere 118KB

When the first 118KB of the executable file was extracted and analyzed using the reverse engineering tool IDA Pro , code was found that repeatedly manipulates global variables using XOR operations. This is a typical obfuscation technique used to complicate the decompiler's output and make analysis difficult. [code] dword_14000C020 ^= 0xF2C2EAC0; v34 = 0; dword_14000C020 ^= 0xF2C2EAC0; [code] After removing all obfuscation logic and leaving only the actual malware's operational logic, it was reduced to the following six steps. It has been confirmed that this entire process runs entirely in memory, without any access to disk. 1. Open yourself as a file. 2. Read the last 64 bytes of the file. 3. Use the loaded data to find and decrypt the payload hidden within the junk data. 4. Manually map the PE (Portable Executable) file into memory. 5. Rewrite the ImageBaseAddress (base address of the executable file) field of the PEB (Process Environment Block) structure to the base address of the payload expanded in memory. 6. Execute the payload. In other words, we can see that the main body of the malware is located in the 'last 64 bytes'. offset size explanation 0x00 32 bytes The key is XORed with the 32-byte mask value in .data. 0x20 12 bytes ChaCha20 Nons 0x2C 4 bytes Payload size ^ fnv1a (mask value) 0x30 4 bytes (flag | padding > 8 key = xor(mask, footer[:32]) nonce = footer[32:44] payload = chacha20(key, nonce, data[-64 - pad - size : -64 - pad]) [code] Analysis revealed that the malware ultimately generates another 929KB PE file. The generated executable file is a highly obfuscated information-stealing malware ( infostealer ) characterized by encrypted strings and imports that are resolved at runtime. Specifically, this infostealer steals the following confidential information: Browsers : Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, Firefox (password, cookies, autofill, Chrome app integration encryption feature) Cryptocurrency wallets : Exodus, Electrum, Atomic, Guarda, Coinomi, Ledger Live, Trezor Suite, Wasabi, Sparrow, Monero, Zcash, Armory, and browser extension wallets. Password managers : KeePass, KeePassXC, Bitwarden, 1Password, NordPass, RoboForm, Windows Credential Manager • Accounts : Telegram, Discord token, Steam, Roblox cookie, Minecraft account, Authy Developer-related : .ssh, .aws, gcloud, .azure, .kube, .docker Remote access : AnyDesk, TeamViewer, WinSCP, FileZilla, mRemoteNG, RDCMan Other : Outlook, Thunderbird, VPN settings, OBS settings, sticky notes, documents on the desktop The stolen information is compressed using zlib and sent to the attacker's server. The address of the command and control server (C2 server) is not hardcoded, but was obtained from the YouTube channel 'bubblegym' (created September 14, 2026) and a GitHub gist. The obtained encrypted address is decrypted by Base64 decoding and an XOR operation with a string such as keyboard smash. [code] b = base64.b64decode('OA0dDQ0HFBQHJyIHEkkQCAlJLS0JTgwAAB8S') k = b'ZhxchsdfhSGdfgsgdfAJsakdaksdk2364236AH' bytes(x ^ k[i % len(k)] for i, x in enumerate(b)) [code] To prevent the spread of malware and minimize damage, Thereallo recommends the following measures: - qBittorrent : Block the download of executable files by adding '*.exe, *.scr, *.lnk, *.bat, *.cmd' to the 'Excluded File Names' in the settings. - Sonarr/Radarr : If an executable file (*.exe) is detected, use the 'Remove from Client' function to add it to the block list. Prowlarr : Consider lowering the rating or completely removing trackers that provide malicious files. Finally, Thereallo advises highly skilled malware developers to find legitimate jobs rather than dedicate their skills to developing shoddy malware.

After removing all obfuscation logic and leaving only the actual malware's operational logic, it was reduced to the following six steps. It has been confirmed that this entire process runs entirely in memory, without any access to disk. 1. Open yourself as a file. 2. Read the last 64 bytes of the file. 3. Use the loaded data to find and decrypt the payload hidden within the junk data. 4. Manually map the PE (Portable Executable) file into memory. 5. Rewrite the ImageBaseAddress (base address of the executable file) field of the PEB (Process Environment Block) structure to the base address of the payload expanded in memory. 6. Execute the payload. In other words, we can see that the main body of the malware is located in the 'last 64 bytes'. offset size explanation 0x00 32 bytes The key is XORed with the 32-byte mask value in .data. 0x20 12 bytes ChaCha20 Nons 0x2C 4 bytes Payload size ^ fnv1a (mask value) 0x30 4 bytes (flag | padding > 8 key = xor(mask, footer[:32]) nonce = footer[32:44] payload = chacha20(key, nonce, data[-64 - pad - size : -64 - pad]) [code] Analysis revealed that the malware ultimately generates another 929KB PE file. The generated executable file is a highly obfuscated information-stealing malware ( infostealer ) characterized by encrypted strings and imports that are resolved at runtime. Specifically, this infostealer steals the following confidential information: Browsers : Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, Firefox (password, cookies, autofill, Chrome app integration encryption feature) Cryptocurrency wallets : Exodus, Electrum, Atomic, Guarda, Coinomi, Ledger Live, Trezor Suite, Wasabi, Sparrow, Monero, Zcash, Armory, and browser extension wallets. Password managers : KeePass, KeePassXC, Bitwarden, 1Password, NordPass, RoboForm, Windows Credential Manager • Accounts : Telegram, Discord token, Steam, Roblox cookie, Minecraft account, Authy Developer-related : .ssh, .aws, gcloud, .azure, .kube, .docker Remote access : AnyDesk, TeamViewer, WinSCP, FileZilla, mRemoteNG, RDCMan Other : Outlook, Thunderbird, VPN settings, OBS settings, sticky notes, documents on the desktop The stolen information is compressed using zlib and sent to the attacker's server. The address of the command and control server (C2 server) is not hardcoded, but was obtained from the YouTube channel 'bubblegym' (created September 14, 2026) and a GitHub gist. The obtained encrypted address is decrypted by Base64 decoding and an XOR operation with a string such as keyboard smash. [code] b = base64.b64decode('OA0dDQ0HFBQHJyIHEkkQCAlJLS0JTgwAAB8S') k = b'ZhxchsdfhSGdfgsgdfAJsakdaksdk2364236AH' bytes(x ^ k[i % len(k)] for i, x in enumerate(b)) [code] To prevent the spread of malware and minimize damage, Thereallo recommends the following measures: - qBittorrent : Block the download of executable files by adding '*.exe, *.scr, *.lnk, *.bat, *.cmd' to the 'Excluded File Names' in the settings. - Sonarr/Radarr : If an executable file (*.exe) is detected, use the 'Remove from Client' function to add it to the block list. Prowlarr : Consider lowering the rating or completely removing trackers that provide malicious files. Finally, Thereallo advises highly skilled malware developers to find legitimate jobs rather than dedicate their skills to developing shoddy malware.

Analysis revealed that the malware ultimately generates another 929KB PE file. The generated executable file is a highly obfuscated information-stealing malware ( infostealer ) characterized by encrypted strings and imports that are resolved at runtime. Specifically, this infostealer steals the following confidential information: Browsers : Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, Firefox (password, cookies, autofill, Chrome app integration encryption feature) Cryptocurrency wallets : Exodus, Electrum, Atomic, Guarda, Coinomi, Ledger Live, Trezor Suite, Wasabi, Sparrow, Monero, Zcash, Armory, and browser extension wallets. Password managers : KeePass, KeePassXC, Bitwarden, 1Password, NordPass, RoboForm, Windows Credential Manager • Accounts : Telegram, Discord token, Steam, Roblox cookie, Minecraft account, Authy Developer-related : .ssh, .aws, gcloud, .azure, .kube, .docker Remote access : AnyDesk, TeamViewer, WinSCP, FileZilla, mRemoteNG, RDCMan Other : Outlook, Thunderbird, VPN settings, OBS settings, sticky notes, documents on the desktop The stolen information is compressed using zlib and sent to the attacker's server. The address of the command and control server (C2 server) is not hardcoded, but was obtained from the YouTube channel 'bubblegym' (created September 14, 2026) and a GitHub gist. The obtained encrypted address is decrypted by Base64 decoding and an XOR operation with a string such as keyboard smash. [code] b = base64.b64decode('OA0dDQ0HFBQHJyIHEkkQCAlJLS0JTgwAAB8S') k = b'ZhxchsdfhSGdfgsgdfAJsakdaksdk2364236AH' bytes(x ^ k[i % len(k)] for i, x in enumerate(b)) [code] To prevent the spread of malware and minimize damage, Thereallo recommends the following measures: - qBittorrent : Block the download of executable files by adding '*.exe, *.scr, *.lnk, *.bat, *.cmd' to the 'Excluded File Names' in the settings. - Sonarr/Radarr : If an executable file (*.exe) is detected, use the 'Remove from Client' function to add it to the block list. Prowlarr : Consider lowering the rating or completely removing trackers that provide malicious files. Finally, Thereallo advises highly skilled malware developers to find legitimate jobs rather than dedicate their skills to developing shoddy malware.

The obtained encrypted address is decrypted by Base64 decoding and an XOR operation with a string such as keyboard smash. [code] b = base64.b64decode('OA0dDQ0HFBQHJyIHEkkQCAlJLS0JTgwAAB8S') k = b'ZhxchsdfhSGdfgsgdfAJsakdaksdk2364236AH' bytes(x ^ k[i % len(k)] for i, x in enumerate(b)) [code] To prevent the spread of malware and minimize damage, Thereallo recommends the following measures: - qBittorrent : Block the download of executable files by adding '*.exe, *.scr, *.lnk, *.bat, *.cmd' to the 'Excluded File Names' in the settings. - Sonarr/Radarr : If an executable file (*.exe) is detected, use the 'Remove from Client' function to add it to the block list. Prowlarr : Consider lowering the rating or completely removing trackers that provide malicious files. Finally, Thereallo advises highly skilled malware developers to find legitimate jobs rather than dedicate their skills to developing shoddy malware.

To prevent the spread of malware and minimize damage, Thereallo recommends the following measures: - qBittorrent : Block the download of executable files by adding '*.exe, *.scr, *.lnk, *.bat, *.cmd' to the 'Excluded File Names' in the settings. - Sonarr/Radarr : If an executable file (*.exe) is detected, use the 'Remove from Client' function to add it to the block list. Prowlarr : Consider lowering the rating or completely removing trackers that provide malicious files. Finally, Thereallo advises highly skilled malware developers to find legitimate jobs rather than dedicate their skills to developing shoddy malware.

The internal structure of ChatGPT's bot detection system 'Turnstile' and the full details of the Sentinel Challenge have been revealed.

BitTorrent version 2 is SHA256 compliant, more secure, and has a hash tree for efficiency

I tried to find out the character string that was mosaicked with 'Depix' that can easily disable mosaic processing

How to exploit WPA / WPA2 to easily steal passwords from modern Wi-Fi routers

Free software "WebBrowserPassView" to extract passwords from each browser

Command list to disable 'Siri' on Mac & installation method of script 'Kill Siri' to automate Siri disable Summary

'Google Chrome 139' stable release, abolishes automatic detection of ISO-2022-JP

A Trojan horse that takes over the PC is mixed in the fan-made version 'Super Mario' downloaded millions of times

Oct 19, 2026 06:00:00 in Software , Security , Posted by log1c_sh