MovieReaper modular malware spreads via compromised itorrents.org torrent repository, using Solana blockchain for C2
Kaspersky identified MovieReaper, a previously unknown modular, multi-stage crimeware framework distributed since mid-August 2026 through movie-themed torrents, including fake "The Odyssey (2026)" releases. Rather than compromising individual trackers, the actor modified the public torrent file repository itorrents[.]org, so trackers relying on it served malicious torrents. Several hundred victims, both individuals and organizations, were identified across Europe, Asia, Africa and Latin America. Activity by the same actor dates back to October 2025, and the repository was reported still compromised at publication. Kaspersky detects the threat as HEUR:Trojan.Win64.Agent.gen.
Technical Details
- Stage 1 (loader): a user-executed EXE with a long filename and a well-known app icon, usually mimicking a movie (MD5 A0B13781EDD7CFDAB13D79AFFF3C83C1 for the most common sample). It creates a global mutex, resolves APIs by walking the PEB Ldr list instead of calling LoadLibrary/GetProcAddress, and uses custom stream-cipher string encryption plus sandbox checks.
- The loader downloads shellcode in parts from deadhub[.]org (fallback 193.23.118[.]155 over plain HTTP), maps it to RWX memory, uses a vectored exception handler to perform a raw NtProtectVirtualMemory syscall, and executes it via the undocumented EtwpCreateEtwThread.
- Stage 2: queries the Solana blockchain (api.mainnet.solana.com, getAccountInfo) for an account holding the XOR-encrypted, base64-encoded second C2 address. It then communicates over HTTPS with a TLS-pinned certificate using nanopb protobuf, and can load COFF modules and run their module_init function.
- Stage 3: UAC bypass and persistence using public techniques; the binary masquerades as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe and restarts with a special argument that skips anti-sandbox checks. The beacon tells the C2 whether it is a first-run or respawned instance.
- Stage 4: a "file manager" module with 21 commands covering file download/upload/read, directory listing, create/copy/rename/move/delete/chmod/symlink, and preview/thumbnail exfiltration. Other modules may be loaded on demand.
- Targeted sectors include enterprise, government, IT, consulting, retail, transportation and agriculture.
- Second-stage C2: 208.64.33[.]90, 208.94.246[.]53. Solana account: 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm; program: CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL.
Remediation
- Block the first-stage domain and IP and the second-stage C2 IPs; take down or block the first-stage server to prevent later stages, since the Solana-based C2 is resilient to conventional takedown.
- Hunt for the listed hashes, the mutexes and the msedge.exe file in the Telemetry folder under ProgramData.
- Prevent users from downloading pirated content and executing EXE files delivered as media; do not disable antivirus on the advice of installation guides.
- Treat torrent downloads from itorrents[.]org-reliant trackers as untrusted while the repository remains compromised.
Linha do tempo
-
MovieReaper modular malware spreads via compromised itorrents.org torrent repository, using Solana blockchain for C2
ler a análise desta fonte ocultar
Kaspersky identified MovieReaper, a previously unknown modular, multi-stage crimeware framework distributed since mid-August 2026 through movie-themed torrents, including fake "The Odyssey (2026)" releases. Rather than compromising individual trackers, the actor modified the public torrent file repository itorrents[.]org, so trackers relying on it served malicious torrents. Several hundred victims, both individuals and organizations, were identified across Europe, Asia, Africa and Latin America. Activity by the same actor dates back to October 2025, and the repository was reported still compromised at publication. Kaspersky detects the threat as HEUR:Trojan.Win64.Agent.gen.
Technical Details
- Stage 1 (loader): a user-executed EXE with a long filename and a well-known app icon, usually mimicking a movie (MD5 A0B13781EDD7CFDAB13D79AFFF3C83C1 for the most common sample). It creates a global mutex, resolves APIs by walking the PEB Ldr list instead of calling LoadLibrary/GetProcAddress, and uses custom stream-cipher string encryption plus sandbox checks.
- The loader downloads shellcode in parts from deadhub[.]org (fallback 193.23.118[.]155 over plain HTTP), maps it to RWX memory, uses a vectored exception handler to perform a raw NtProtectVirtualMemory syscall, and executes it via the undocumented EtwpCreateEtwThread.
- Stage 2: queries the Solana blockchain (api.mainnet.solana.com, getAccountInfo) for an account holding the XOR-encrypted, base64-encoded second C2 address. It then communicates over HTTPS with a TLS-pinned certificate using nanopb protobuf, and can load COFF modules and run their module_init function.
- Stage 3: UAC bypass and persistence using public techniques; the binary masquerades as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe and restarts with a special argument that skips anti-sandbox checks. The beacon tells the C2 whether it is a first-run or respawned instance.
- Stage 4: a "file manager" module with 21 commands covering file download/upload/read, directory listing, create/copy/rename/move/delete/chmod/symlink, and preview/thumbnail exfiltration. Other modules may be loaded on demand.
- Targeted sectors include enterprise, government, IT, consulting, retail, transportation and agriculture.
- Second-stage C2: 208.64.33[.]90, 208.94.246[.]53. Solana account: 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm; program: CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL.
Remediation
- Block the first-stage domain and IP and the second-stage C2 IPs; take down or block the first-stage server to prevent later stages, since the Solana-based C2 is resilient to conventional takedown.
- Hunt for the listed hashes, the mutexes and the msedge.exe file in the Telemetry folder under ProgramData.
- Prevent users from downloading pirated content and executing EXE files delivered as media; do not disable antivirus on the advice of installation guides.
- Treat torrent downloads from itorrents[.]org-reliant trackers as untrusted while the repository remains compromised.