MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2

A newly identified Windows malware framework dubbed MovieReaper is being distributed through pirated movie torrents after threat actors compromised a public torrent-file repository used by multiple tracker sites.

The campaign combines a multi-stage infection chain, anti-analysis techniques, UAC bypass, file-management capabilities, and Solana blockchain-based command-and-control (C2) discovery to make disruption more difficult.

Kaspersky researchers identified the campaign in mid-August 2026 while investigating infections affecting both consumers and organizations.

Victims have been detected across Europe, Asia, Africa, and Latin America, including Russia, Türkiye, Japan, Kenya, Uganda, Colombia, Spain, the Netherlands, Belgium, and Germany.

Targeted organizations span enterprise, government, IT, consulting, retail, transportation, and agriculture sectors.

The campaign does not appear to involve direct compromises of individual torrent trackers. Instead, the operators compromised itorrents[.]org, a public torrent-file repository that tracker websites use to retrieve torrent data.

This upstream compromise enables attackers to poison downloads across several dependent services at once, without needing to breach each tracker individually. Kaspersky said the archive remained compromised at the time of publication.

When a user attempts to obtain content through a magnet link, the repository can return a malicious torrent rather than the expected file.

The payload is disguised as a popular movie release, with observed filenames such as the odyssey (2026) [1080p] [webrip] [5.1].exe.

Long filenames and familiar application icons are used to obscure the executable extension and increase the chance that a victim manually launches the file. Kaspersky detects the threat as HEUR:Trojan.Win64.Agent.gen.

The loader is engineered to frustrate sandboxing and static analysis.

Rather than relying on conventional LoadLibrary and GetProcAddress calls, it walks the Windows Process Environment Block (PEB) loader structures and manually parses loaded DLLs to resolve required functions. Its strings are encrypted with a custom stream cipher.

Following its environment checks, the loader contacts deadhub[.]org to retrieve shellcode disguised as image-related paths, including URLs ending in .png and .jpg.

If the domain is unavailable, it falls back to 193.23.118[.]155 over plain HTTP. The shellcode is mapped into read-write-execute memory, while execution uses a vectored exception handler and the undocumented EtwpCreateEtwThread routine instead of the more conventional CreateThread API.

Kaspersky said in a report shared with GBhackers, MovieReaper begins with a loader that creates a randomly named global mutex, preventing multiple simultaneous instances.

MovieReaper Malware

The second stage adds the campaign’s most notable infrastructure feature: Solana-based C2 resolution.

It queries Solana’s getAccountInfo endpoint for the account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm. The account data contains a Base64-encoded and XOR-encrypted address for the next-stage C2 server.

Attackers used the Solana program CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL to store this information.

Using a public blockchain as a C2-address distribution layer gives the operators an important resilience advantage.

Defenders can block a known server or IP address, but attackers can update the next destination through on-chain account data, reducing reliance on a single conventional hosting provider.

The second-stage implant communicates over HTTPS with certificate pinning and uses nanopb Protocol Buffers to package transferred data.

A subsequent module bypasses Windows User Account Control and establishes persistence by masquerading the malware as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe.

The process restarts with a command-line argument that skips most initial anti-sandbox checks, then contacts the C2 again to retrieve additional modules.

The final recovered module functions as a remote file manager with 21 commands. It can list directories, read, upload, download, create, copy, move, rename, delete, modify permissions, and create symbolic links.

It can also generate file and image previews or thumbnails, enabling operators to assess potentially valuable content before full-scale data theft. Researchers believe other modules could be delivered on demand.

The first-stage infrastructure is the most practical disruption point because it depends on the single domain deadhub[.]org and fallback IP 193.23.118[.]155.

Security teams should hunt for executions from suspicious movie-named .exe files, unusual binaries in the Windows Telemetry path, outbound requests to the identified infrastructure, and Solana RPC queries from endpoints that have no legitimate blockchain-related business purpose.

MovieReaper also illustrates the risk of upstream dependency compromise in torrent ecosystems: a poisoned shared repository can silently turn multiple tracker sites into malware distribution channels.

Organizations should block torrent-related activity where appropriate, enforce application-control policies, prevent execution from download directories, and investigate endpoints that have downloaded purported media files containing executable payloads.

Indicators of compromise

IOC Type	Indicator
File Hash (MD5)	4334BBAEA8DE33BF9D45E9B4E4E3BC2
File Hash (MD5)	4843F9FAFCAE492F11E2D4D33DBB4CDD
File Hash (MD5)	5310CABAE3FBE6DB8742849B588093F9
File Hash (MD5)	A0B13781EDD7CFDAB13D79AFFF3C83C1
First-stage C2 Domain	deadhub[.]org
First-stage C2 IP Address	193.23.118[.]155
Second-stage C2 IP Address	208.64.33[.]90
Second-stage C2 IP Address	208.94.246[.]53

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC