MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2

Key facts for MovieReaper Solana Blockchain RAT

Detection coverage for MovieReaper Solana Blockchain RAT

As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2560 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: MovieReaper Decoy Torrent Payload Execution (Loader Stage 1)

Detects execution of the MovieReaper stage-1 loader delivered via the compromised itorrents.org repository: process creation matching a published sample hash, the "The Odyssey" decoy filename pattern, or an unsigned .exe spawned as a child of a torrent-client process from a Downloads/Temp working directory.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1204.002
• Data sources: sysmon, windows_security, edr_process_telemetry
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval decoy_hash=if(match(Hashes, "(?i)(A0B13781EDD7CFDAB13D79AFFF3C83C1|4334BBAEA8DE33BF9D45E9B4E4E3BC2|4843F9FAFCAE492F11E2D4D33DBB4CDD|5310CABAE3FBE6DB8742849B588093F9|70060341CAF3338697A7DDFE0FB62875|AD4643EEA15AC286FA47D1131F9EF756|D0B967571AC8A3863C7F324BF5BDE99C|D88D550D0FB8E60CFFFF3EA61FF7A067)"), 1, 0)
| eval decoy_name=if(match(lower(Image), "the odyssey.*2026.*1080p.*webrip"), 1, 0)
| eval torrent_parent=if(match(lower(ParentImage), "(qbittorrent|utorrent|bittorrent|transmission-qt|deluge)\.exe"), 1, 0)
| where decoy_hash=1 OR decoy_name=1 OR (torrent_parent=1 AND match(lower(Image), "\.exe$") AND NOT match(lower(Image), "(program files|windows\\system32)"))
| table _time, ComputerName, User, ParentImage, Image, CommandLine, Hashes
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where MD5 in~ ("A0B13781EDD7CFDAB13D79AFFF3C83C1","4334BBAEA8DE33BF9D45E9B4E4E3BC2","4843F9FAFCAE492F11E2D4D33DBB4CDD","5310CABAE3FBE6DB8742849B588093F9","70060341CAF3338697A7DDFE0FB62875","AD4643EEA15AC286FA47D1131F9EF756","D0B967571AC8A3863C7F324BF5BDE99C","D88D550D0FB8E60CFFFF3EA61FF7A067")
    or (FileName has "the odyssey" and FileName has "2026" and FileName has "1080p")
    or (InitiatingProcessFileName in~ ("qbittorrent.exe","utorrent.exe","bittorrent.exe","transmission-qt.exe","deluge.exe") and FileName endswith ".exe" and not(FolderPath has_any ("Program Files","Windows\\System32")))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, MD5

Sigma

title: MovieReaper Decoy Torrent Payload Execution
id: 7c1a2e4d-9b3f-4a2e-8e1c-1a2b3c4d5e6f
status: experimental
description: Detects execution of the MovieReaper stage-1 loader delivered via the compromised itorrents.org repository, matched by published sample hashes, the "The Odyssey" decoy filename, or an unsigned .exe spawned by a torrent client.
references:
    - https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/18
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1204.002
    - attack.tool.moviereaper
logsource:
    category: process_creation
    product: windows
detection:
    selection_hash:
        Hashes|contains:
            - 'A0B13781EDD7CFDAB13D79AFFF3C83C1'
            - '4334BBAEA8DE33BF9D45E9B4E4E3BC2'
            - '4843F9FAFCAE492F11E2D4D33DBB4CDD'
            - '5310CABAE3FBE6DB8742849B588093F9'
            - '70060341CAF3338697A7DDFE0FB62875'
            - 'AD4643EEA15AC286FA47D1131F9EF756'
            - 'D0B967571AC8A3863C7F324BF5BDE99C'
            - 'D88D550D0FB8E60CFFFF3EA61FF7A067'
    selection_decoy:
        Image|contains|all:
            - 'the odyssey'
            - '2026'
            - '1080p'
        Image|endswith: '.exe'
    selection_torrent_parent:
        ParentImage|endswith:
            - '\qbittorrent.exe'
            - '\utorrent.exe'
            - '\bittorrent.exe'
            - '\transmission-qt.exe'
            - '\deluge.exe'
        Image|endswith: '.exe'
        Image|contains:
            - '\Downloads\'
            - '\Temp\'
    condition: selection_hash or selection_decoy or selection_torrent_parent
falsepositives:
    - Legitimate torrent clients downloading unrelated executables (e.g., open-source software distributed via torrent)
level: high

Known false positives:

• Legitimate torrent clients downloading unrelated software distributed via magnet link/torrent

Tuning notes: Keep the published MD5 hash list current as Kaspersky/others release additional samples; the torrent-parent heuristic is broader and should be scoped to unsigned/uncommon publishers to reduce noise in environments where torrent clients are sanctioned.

• 🔒 MovieReaper Minimal-Module-Load API Resolution Evasion · unlock with TL Creds
• 🔒 MovieReaper Reflective COFF Module Load (No Disk Artifact) · unlock with TL Creds
• 🔒 MovieReaper Disguised Image-Path Shellcode Staging Beacon · unlock with TL Creds
• 🔒 MovieReaper Loader Sandbox/VM Environment Check · unlock with TL Creds
• 🔒 MovieReaper Persistent Respawn With Anti-Sandbox-Skip Flag · unlock with TL Creds
• 🔒 MovieReaper Second-Stage C2 Connection With File-Manager Recon Burst · unlock with TL Creds
• 🔒 MovieReaper UAC Bypass & msedge.exe ProgramData Masquerade · unlock with TL Creds
• 🔒 MovieReaper Solana Blockchain Dead-Drop C2 Resolution · unlock with TL Creds

Indicators of compromise for MovieReaper Solana Blockchain RAT

As of 2026-09-18, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-2560.

Sample indicators (3 of 22)

• IP address: 193.23.118[.]155
• Domain: deadhub[.]org
• File hash: A0B13781EDD7CFDAB13D79AFFF3C83C1

Defanged, TLP:CLEAR. Full set of 22 indicators: unlock with TL Creds.

How MovieReaper Solana Blockchain RAT works

Kaspersky (detection: HEUR:Trojan.Win64.Agent.gen) traced several hundred victims across ten-plus countries and confirmed the repository remained compromised at time of publication.

MovieReaper is a four-to-five-stage modular Windows trojan framework first traced by Kaspersky GReAT researchers Konstantin Isakov and Pavel Cheremushkin to activity beginning October 2025, with the current campaign identified in mid-August 2026 and confirmed via a September 17, 2026 investigation. Rather than compromising individual torrent trackers, the operators compromised itorrents[.]org — a centralized, shared repository of torrent metadata files relied upon by multiple independent tracker sites — so that magnet-link requests for popular movie releases (observed decoy: "the odyssey (2026) [1080p] [webrip] [5.1].exe") returned a malicious .exe instead of the legitimate torrent. This single-point compromise let the actor reach users across many trackers without breaching each platform individually, and the repository remained compromised as of the report's publication.

Stage 1 (loader, detected as HEUR:Trojan.Win64.Agent.gen) creates a randomly generated global mutex (observed values include Global\fnulSktzSqvVLXHU and Global\E4AyDKzvEhe2hgAr) to prevent multiple concurrent instances, then performs anti-analysis: strings are protected with a custom stream cipher, and API addresses are resolved via manual Windows PEB/Ldr traversal and direct DLL parsing rather than conventional LoadLibrary/GetProcAddress calls. The loader registers a vectored exception handler and manually invokes NtProtectVirtualMemory by locating the raw syscall instruction (0x0F 0x05) inside ntdll, then executes retrieved code via the undocumented EtwpCreateEtwThread routine instead of CreateThread — evading hooks placed on conventional thread-creation APIs. The loader also performs sandbox/VM detection before proceeding.

Stage 2 shellcode is retrieved from deadhub[.]org over HTTPS (with a plaintext HTTP fallback to 193.23.118[.]155), disguised behind randomized image-style URI paths mimicking a cloud-storage UI asset tree — observed examples include /cloud/v192.4/ui/sync-status-icons.png, /cloud/v192.4/onboarding/welcome-bg.jpg, /cloud/v192.4/ui/file-preview-placeholder.png, and /cloud/v192.4/shared/link-banner.jpg. This shellcode then queries the Solana blockchain's public getAccountInfo RPC endpoint (api.mainnet.solana.com) against account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm (associated program address CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL), extracting a base64-encoded second-stage C2 address decrypted with a static XOR key from the account's on-chain data field. This gives the operators a resilient, takedown-resistant infrastructure layer: they can rotate the live C2 IP by updating the Solana account rather than re-infecting hosts. Observed second-stage C2 IPs are 208.64.33[.]90 and 208.94.246[.]53, reached over HTTPS with TLS certificate pinning; data is containerized using the nanopb Protocol Buffers library, and additional modules are delivered and executed in memory as parsed COFF objects via a module_init routine (reflective loading, no additional payload written to disk). Neither second-stage IP returned an existing BeaconBeagle C2 correlation record at research time (queried 2026-09-18; both endpoints 404 — no prior beacon/config match on file), consistent with freshly rotated, purpose-built infrastructure rather than reused/shared C2.

A UAC-bypass stage relocates/respawns the binary as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe — masquerading as a legitimate Microsoft Edge telemetry component in a plausible ProgramData path — with a command-line flag that causes the respawned instance to skip the anti-sandbox checks performed on first run, and a beacon flag informs the C2 whether the host is a fresh or already-persistent install so the appropriate follow-on module is delivered. Public reporting does not disclose the specific UAC-bypass method (e.g., fodhelper/eventvwr-style) or a boot-persistence artifact (no registry Run key or scheduled task name has been published), only the relocation/masquerade and respawn behavior described above.

The final delivered module is a file-manager implant exposing 21 commands covering directory listing/enumeration, file read/upload/download, create/copy/move/rename/delete, permission (chmod-style) changes, symbolic-link creation, and file/image preview or thumbnail extraction — the last explicitly noted as supporting pre-exfiltration reconnaissance before an operator pulls specific files. Additional modules can be requested from C2 on demand.

The "The Odyssey" decoy filename tracks a real theatrical release (July 15, 2026), and Kaspersky frames the campaign as an evolution of the October 2025-origin activity, with incrementally improved detector/sandbox-evasion techniques observed over the roughly eleven-month window before the itorrents[.]org compromise was confirmed.

Kaspersky identified several hundred victims, both individuals and organizations, with infection attempts observed across Europe, Asia, and Africa, and corroborating reporting listing Russia, Turkiye, Japan, Kenya, Uganda, Colombia, Nepal, Tanzania, Ghana, Spain, the Netherlands, Belgium, Finland, and Germany (France notably absent from all reported victim lists); organizational victims spanned government, IT, consulting, retail, transportation, and agriculture sectors. No CVE applies — this is a social-engineering/supply-chain-style distribution-repository compromise, not a software vulnerability, and no threat-actor name or nation-state attribution has been published. One secondary aggregator (CraftedSignal) additionally attributed a registry-based UAC-bypass persistence technique and a "blockchain DGA" classification to MovieReaper; both are excluded here as unsupported by, and directly contradicted by, Kaspersky's primary Securelist research, which states explicitly that no registry Run key or scheduled-task artifact has been published and describes the Solana lookup as a dead-drop resolver rather than a domain-generation algorithm.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1027.007 Dynamic API Resolution; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1132.001 Standard Encoding

Execution

T1106 Native API; T1204.002 Malicious File

Initial Access

T1195.002 Compromise Software Supply Chain

Discovery

T1497 Virtualization/Sandbox Evasion

Privilege Escalation

T1548.002 Bypass User Account Control

Resource Development

T1608.001 Upload Malware

Remediation for MovieReaper Solana Blockchain RAT

Immediate actions

• Block network indicators deadhub[.]org, 193.23.118[.]155, 208.64.33[.]90, and 208.94.246[.]53 at DNS/proxy/perimeter firewalls
• Hunt EDR/file-integrity telemetry for C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe (the real msedge.exe never lives in ProgramData) and isolate/quarantine any match
• Search endpoint and file-hash telemetry for the eight published MovieReaper MD5 hashes; treat any match as a confirmed compromise requiring full incident response
• Notify users/IT that itorrents[.]org-sourced torrent files are malicious regardless of which tracker referenced them, and block the domain at network egress until the repository operator confirms remediation

Workarounds

• Avoid downloading or executing any torrent file sourced via itorrents[.]org until the repository operator confirms remediation
• Treat any .exe delivered by a torrent client as untrusted regardless of the display name/extension shown by the requesting tracker

Longer-term hardening

• Add detection logic for endpoint processes making outbound getAccountInfo-style JSON-RPC calls to public blockchain RPC endpoints (e.g. api.mainnet.solana.com) — an emerging dead-drop-resolver C2 pattern not covered by traditional domain/IP reputation feeds
• Enforce application allowlisting or ASR rules blocking unsigned executables launched from Downloads/Temp or torrent-client working directories
• Deploy TLS-inspection/egress monitoring capable of flagging certificate-pinned, protobuf-serialized C2 traffic patterns distinct from normal HTTPS
• Run a user-awareness campaign on piracy-sourced malware risk given the confirmed, still-active compromise of a widely trusted shared torrent-file repository

Affected and fixed versions

• Microsoft — Windows (Desktop)
  Vulnerable versions: All currently supported Windows 10/11 desktop builds capable of running a standard 64-bit executable — infection is via user execution of a disguised loader, not a version-specific software flaw

Timeline of MovieReaper Solana Blockchain RAT

• 2025-10-01 Kaspersky links earlier activity by the same threat actor to October 2025, roughly ten months before the confirmed locked-ioc-21 campaign (exact day not disclosed in public reporting); Kaspersky characterizes the campaign as evolving over this window with incrementally improved anti-sandbox and detector-evasion techniques.
• 2026-07-15 "The Odyssey" has its real-world theatrical release; the film's title and 2026 release year are later reused verbatim as the decoy filename ("locked-ioc-3") served by the compromised locked-ioc-18 repository.
• 2026-08-15 Kaspersky begins investigating the locked-ioc-21 campaign after identifying malicious torrent downloads disguised as movie releases (mid-August 2026; exact day not disclosed).
• 2026-09-17 Kaspersky GReAT (Konstantin Isakov, Pavel Cheremushkin) publishes locked-ioc-21 technical research on Securelist, detailing the multi-stage loader, Solana blockchain C2-resolution mechanism, UAC bypass, and 21-command file-manager implant.
• 2026-09-17 Kaspersky researchers confirm locked-ioc-18, a shared public torrent-file repository used by multiple trackers, is compromised and serving locked-ioc-21 payloads in place of legitimate torrent files, with several hundred victims identified across multiple countries.
• 2026-09-18 Security trade press (GBHackers, Gridinsoft, it-connect.tech, NetManageIT) reports on the Kaspersky findings; locked-ioc-18 remains compromised and actively serving the malicious payload at time of publication.

Sources cited for MovieReaper Solana Blockchain RAT

• MovieReaper: Trojan attack via movie torrents, including "The Odyssey" Kaspersky Securelist · Research · 2026-09-17
• MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2 gbhackers.com · Blog · 2026-09-18
• MovieReaper Turns Movie Torrents Into Remote File Access blog.gridinsoft.com · Blog · 2026-09-18
• MovieReaper Torrent Trojan and Solana C2 Analysis blog.netmanageit.com · Blog · 2026-09-18
• iTorrents.org compromised to spread a Windows malware loader instead of movies it-connect.tech · News · 2026-09-17

More in malware

• YobaLoader Campaign: DLL Sideloading in Signed OpenAI/Anthropic-Themed Binaries via Fake GitHub Repositories Delivering XMRig
• Radio Exploit Kit drive-by download campaign exploiting CVE-2016-0189 to deliver AZORult
• Bottle Exploit Kit (BottleEK) - Malvertising Campaign Targeting Japanese Users via CVE-2018-8174 and CVE-2018-15982
• Exploit kits remain active in April 2021: RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude targeting Internet Explorer (CVE-2020-0674, CVE-2021-26411, CVE-2018-8174, CVE-2018-15982, CVE-2020-1380)
• Fake Security Tools on GitHub Deliver AsyncRAT, Clipper and Infostealer via Trojan.Loader.3261 Electron Loader (Microsoft.exe)

Previous and next in malware

• AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28) Previous report
• ClearFake Drive-By Cluster Fuels CastleLoader Paste-and-Run Delivery of NetSupport RAT, CastleRAT, and a .NET Stealer Next report