The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents

Immediate Actions

Key Takeaways

• Compromised public torrent repository itorrents.org to distribute malicious torrents across multiple trackers.
• Loader avoids standard API calls by traversing PEB and manually parsing DLLs for function addresses.
• Uses Solana blockchain account to store encrypted second-stage C2 address for resilience.
• Final 'file manager' module exposes 21 commands for remote filesystem access and data exfiltration.
• Masquerades as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe for persistence.

Attack Chain

1. Initial Access: Malicious torrent files from compromised itorrents.org deliver loader EXE disguised as movies
2. Execution: Loader avoids standard APIs, downloads shellcode from first-stage C2 (deadhub.org or 193.23.118.155)
3. C2: Shellcode queries Solana blockchain to retrieve encrypted second-stage C2 address
4. Persistence: UAC bypass module masquerades as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe and restarts
5. Exfiltration: Final 'file manager' module provides 21 filesystem commands for remote access and data theft

Affected Systems

• Windows systems downloading torrents from affected trackers
• Users of itorrents.org-dependent torrent trackers

Detection Availability

No detection rules or queries are published in the source article.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Process creation logs (Event ID 4688)
• Network connection logs
• DNS resolution logs
• File creation events in ProgramData
• Mutex creation events

Key Behavioral Indicators

• msedge.exe executing from C:\ProgramData\Microsoft\Windows\Telemetry\
• Global mutex with random alphanumeric string pattern
• HTTP requests to deadhub.org or 193.23.118.155 with image file paths
• Process creating RWX memory and registering vectored exception handler
• Solana blockchain API query followed by new HTTPS connection
• Long filename with .exe extension masquerading as media file

Control Gaps

• Standard AV signatures may miss fileless shellcode execution
• TLS pinning prevents SSL inspection of second-stage C2
• Solana blockchain queries appear as legitimate API traffic
• PEB-based API resolution bypasses API hooking defenses

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Block traffic to itorrents.org on corporate networks
• Monitor and alert on connections to api.mainnet.solana.com from non-developer hosts
• Enable TLS inspection where possible to detect second-stage C2

User Protection

• Warn users about downloading content from torrent trackers
• Ensure endpoint protection is active and not disabled by users
• Deploy EDR rules for msedge.exe running from ProgramData\Telemetry path

Security Awareness

• Educate users that pirated software and media are common malware vectors
• Reinforce policy against disabling antivirus or endpoint protection
• Advise users to verify file extensions before opening downloaded media files

MITRE ATT&CK Mapping

Plain-Language Summary

Attackers compromised a public torrent file repository to spread malware disguised as popular movies. When users download these torrents, they receive a malicious program that connects to attacker servers using the Solana blockchain to hide its tracks. The malware gives attackers remote access to files on the victim's computer. Users should avoid downloading pirated content and ensure their antivirus is active.

Additional IOCs

• File Hashes:
  • A0B13781EDD7CFDAB13D79AFFF3C83C1 (MD5) - Primary loader executable distributed via torrents
  • 4334BBAEA8DE33BF9D45E9B4E4E3BC2 (MD5) - Malware sample hash
  • 4843F9FAFCAE492F11E2D4D33DBB4CDD (MD5) - Malware sample hash
  • 5310CABAE3FBE6DB8742849B588093F9 (MD5) - Malware sample hash
  • 70060341CAF3338697A7DDFE0FB62875 (MD5) - Malware sample hash
  • AD4643EEA15AC286FA47D1131F9EF756 (MD5) - Malware sample hash
  • D0B967571AC8A3863C7F324BF5BDE99C (MD5) - Malware sample hash
  • D88D550D0FB8E60CFFFF3EA61FF7A067 (MD5) - Malware sample hash
• File Paths:
  • %ProgramData%\Microsoft\Windows\Telemetry\msedge.exe - Persistence path for masqueraded loader binary
• Command Lines:
  • Purpose: Loader restarts with special argument to skip anti-sandbox checks | Tools: msedge.exe | Stage: Persistence | msedge.exe <special_argument>
• Other:
  • 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm - Solana blockchain account storing encrypted second-stage C2 address
  • CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL - Solana program used by attackers for C2 address storage