MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2
Kaspersky reports MovieReaper malware distributed via compromised torrent repository itorrents.org, using Solana blockchain for resilient C2 across four continents.
Kaspersky identified a multi-stage Windows malware framework, detected as HEUR:Trojan.Win64.Agent.gen, delivered through pirated movie torrents after operators compromised the shared repository itorrents[.]org, poisoning magnet-link downloads across multiple dependent tracker sites. The loader evades analysis via PEB walking, custom stream-cipher string encryption, and shellcode from deadhub[.]org, while a second-stage implant resolves C2 addresses through Solana getAccountInfo queries to a hardcoded on-chain account. A later module bypasses UAC and masquerades as msedge.exe in the Windows Telemetry path, ultimately deploying a 21-command remote file manager. Victims were detected in enterprise, government, IT, retail, transportation, and agriculture sectors across Europe, Asia, Africa, and Latin America.
- Operators compromised itorrents.org to poison torrent downloads across multiple dependent tracker sites at once
- Loader evades sandboxing via PEB walking, encrypted strings, and shellcode fetched as fake .png/.jpg paths
- Solana getAccountInfo queries deliver XOR-encrypted C2 addresses, letting operators reroute infrastructure on-chain
- Final module is a 21-command remote file manager disguised as msedge.exe in the Telemetry directory
- Victims span 11+ countries and sectors including enterprise, government, IT, retail, and transportation
- ATT&CK
- T1204.002 User Execution: Malicious FileT1027 Obfuscated Files or InformationT1548.002 Bypass User Account ControlT1036.005 Masquerading: Match Legitimate Name or Location of FileT1071.001 Application Layer Protocol: Web Protocols
- Vendors
- Kaspersky
- Products
- MovieReaperitorrents.org
- Malware
- MovieReaper
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | deadhub.org | pher. Following its environment checks, the loader contacts deadhub[.]org to retrieve shellcode disguised as image-related paths, i |
| domain | itorrents.org | vidual torrent trackers. Instead, the operators compromised itorrents[.]org , a public torrent-file repository that tracker websites |
| ipv4 | 193.23.118.155 | g and .jpg . If the domain is unavailable, it falls back to 193.23.118[.]155 over plain HTTP. The shellcode is mapped into read-write- |
| ipv4 | 208.64.33.90 | e C2 IP Address 193.23.118[.]155 Second-stage C2 IP Address 208.64.33[.]90 Second-stage C2 IP Address 208.94.246[.]53 Note: IP addre |
| ipv4 | 208.94.246.53 | age C2 IP Address 208.64.33[.]90 Second-stage C2 IP Address 208.94.246[.]53 Note: IP addresses and domains are intentionally defanged |
| md5 | 4843f9fafcae492f11e2d4d33dbb4cdd | Hash (MD5) 4334BBAEA8DE33BF9D45E9B4E4E3BC2 File Hash (MD5) 4843F9FAFCAE492F11E2D4D33DBB4CDD File Hash (MD5) 5310CABAE3FBE6DB8742849B588093F9 File Hash |
| md5 | 5310cabae3fbe6db8742849b588093f9 | Hash (MD5) 4843F9FAFCAE492F11E2D4D33DBB4CDD File Hash (MD5) 5310CABAE3FBE6DB8742849B588093F9 File Hash (MD5) A0B13781EDD7CFDAB13D79AFFF3C83C1 First-stag |
| md5 | a0b13781edd7cfdab13d79afff3c83c1 | Hash (MD5) 5310CABAE3FBE6DB8742849B588093F9 File Hash (MD5) A0B13781EDD7CFDAB13D79AFFF3C83C1 First-stage C2 Domain deadhub[.]org First-stage C2 IP Addre |
From the original article
4 min read at gbhackers.com
A newly identified Windows malware framework dubbed MovieReaper is being distributed through pirated movie torrents after threat actors compromised a public torrent-file repository used by multiple tracker sites.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.