A user running a standard *arr media stack on a NAS noticed that Sonarr had grabbed a fake South Park episode from public torrent trackers. The file was not a video at all but a Windows executable with 2,392 seeders, and it kept failing to import every 90 seconds. Bittorrent marked the download as finished with zero bytes actually written to disk, which the user could not explain.
The user blocklisted the release and then downloaded it again on purpose to find out what it contained. The real program was only 118 KB; the remaining 886 MB was junk appended to the end to defeat scanners. Heavy XOR-based obfuscation was layered over the code to make decompiler output unreadable. Once stripped, the logic was six steps: read a configuration from the file's final 64 bytes, decrypt a hidden payload using ChaCha20, map it into memory without touching disk, and jump into it.
The embedded payload included anti-debugging and anti-sandbox checks, and it used layered encryption on its strings. The user decrypted 601 of 672 encrypted strings. The decrypted list named browsers, crypto wallets, password managers and account stores as targets, indicating credential and wallet theft.
The case shows how malware disguised as media can avoid detection through size padding, runtime resolution and in-memory execution. Users are advised to be wary of executables masquerading as video releases.
Source: Hacker News · Summarized by HeadlinesBriefing