A security researcher recently documented a malware campaign targeting users of automated media management tools, such as the "*arr" stack (Sonarr, Radarr). The malware was distributed on public torrent trackers by masquerading as popular media files, such as episodes of *South Park*. In one instance, a file named with a standard media extension was actually a Portable Executable (EXE) file. While automated tools like Sonarr cannot execute these files, the threat persists for users who manually interact with their download folders and double-click the files.
The article discusses how malware is distributed on public torrent trackers by masquerading as media files for tools like Sonarr.
The malware employs several techniques to evade detection and analysis. The primary file was approximately 887 MB, but the actual executable logic occupied only 118 KB. The remaining 886 MB consisted of random junk data appended to the end of the file, a tactic designed to bypass security scanners that may give up on processing very large files. To further complicate reverse engineering, the author used hundreds of XOR operations to obfuscate the decompiler output. Despite these layers, the core logic is relatively simple: the program opens itself, reads a configuration footer, and uses a ChaCha20 cipher to decrypt a hidden payload into memory. This payload is then mapped as a Portable Executable (PE) in memory, ensuring that the malicious code never touches the physical disk during execution.
Once active, the malware functions as a comprehensive "stealer" designed to harvest a wide array of sensitive data. It targets major web browsers (including Chrome, Brave, and Firefox) to extract passwords, cookies, and autofill data. It also specifically targets cryptocurrency wallets (such as Ledger Live and Trezor Suite), password managers (like Bitwarden and 1Password), and developer credentials (including .ssh and .aws keys). Notably, the malware even targets Windows Sticky Notes, which users often use to store recovery keys or quick notes. The stolen data is compressed using a bundled zlib library and exfiltrated to a remote server. The researcher noted that while the malware uses complex encryption like AES-128-CTR and RC4-hidden S-boxes, the configuration keys were often stored directly within the file, allowing the payload to be decrypted with minimal effort.
To mitigate this risk, the researcher suggests several proactive measures for users of automated download clients. For example, qBittorrent users can add common executable extensions (such as .exe, .scr, and .bat) to an "Excluded file names" list to prevent them from being downloaded in the first place. For those using Sonarr or Radarr, the recommendation is to blacklist these files and use the "Remove from client" command to purge them from the download queue. Additionally, moving to private trackers—which typically have stricter content moderation—can reduce the likelihood of encountering such malicious files compared to public trackers.",