# MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2

> MovieReaper is a multi-stage Windows trojan distributed after threat actors compromised itorrents[.]org, a shared public torrent-file repository, to serve a malicious loader disguised as movie releases such as "The Odyssey" instead of the requested torrent. The loader achieves UAC bypass and masquerades as msedge.exe, then resolves a resilient second-stage C2 address by querying the Solana blockchain's getAccountInfo RPC method, ultimately deploying a 21-command remote file-manager implant. Kaspersky (detection: HEUR:Trojan.Win64.Agent.gen) traced several hundred victims across ten-plus countries and confirmed the repository remained compromised at time of publication.

- **Published:** 2026-09-18T00:00:00Z
- **Last reviewed:** 2026-09-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2560
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-moviereaper-solana-blockchain-rat-tl-2026-2560.webp?v=93361c17 (Threadlinqs threat intel: MovieReaper Malware Solana Blockchain C2: Detection & IOCs (TL-2026-2560) — High severity, 22 IOCs, 9 detection rules.)
- **ID:** TL-2026-2560
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 22 (3 shown free below)

## Description

MovieReaper is a four-to-five-stage modular Windows trojan framework first traced by Kaspersky GReAT researchers Konstantin Isakov and Pavel Cheremushkin to activity beginning October 2025, with the current campaign identified in mid-August 2026 and confirmed via a September 17, 2026 investigation. Rather than compromising individual torrent trackers, the operators compromised itorrents[.]org — a centralized, shared repository of torrent metadata files relied upon by multiple independent tracker sites — so that magnet-link requests for popular movie releases (observed decoy: "the odyssey (2026) [1080p] [webrip] [5.1].exe") returned a malicious .exe instead of the legitimate torrent. This single-point compromise let the actor reach users across many trackers without breaching each platform individually, and the repository remained compromised as of the report's publication.

Stage 1 (loader, detected as HEUR:Trojan.Win64.Agent.gen) creates a randomly generated global mutex (observed values include Global\fnulSktzSqvVLXHU and Global\E4AyDKzvEhe2hgAr) to prevent multiple concurrent instances, then performs anti-analysis: strings are protected with a custom stream cipher, and API addresses are resolved via manual Windows PEB/Ldr traversal and direct DLL parsing rather than conventional LoadLibrary/GetProcAddress calls. The loader registers a vectored exception handler and manually invokes NtProtectVirtualMemory by locating the raw syscall instruction (0x0F 0x05) inside ntdll, then executes retrieved code via the undocumented EtwpCreateEtwThread routine instead of CreateThread — evading hooks placed on conventional thread-creation APIs. The loader also performs sandbox/VM detection before proceeding.

Stage 2 shellcode is retrieved from deadhub[.]org over HTTPS (with a plaintext HTTP fallback to 193.23.118[.]155), disguised behind randomized image-style URI paths mimicking a cloud-storage UI asset tree — observed examples include /cloud/v192.4/ui/sync-status-icons.png, /cloud/v192.4/onboarding/welcome-bg.jpg, /cloud/v192.4/ui/file-preview-placeholder.png, and /cloud/v192.4/shared/link-banner.jpg. This shellcode then queries the Solana blockchain's public getAccountInfo RPC endpoint (api.mainnet.solana.com) against account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm (associated program address CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL), extracting a base64-encoded second-stage C2 address decrypted with a static XOR key from the account's on-chain data field. This gives the operators a resilient, takedown-resistant infrastructure layer: they can rotate the live C2 IP by updating the Solana account rather than re-infecting hosts. Observed second-stage C2 IPs are 208.64.33[.]90 and 208.94.246[.]53, reached over HTTPS with TLS certificate pinning; data is containerized using the nanopb Protocol Buffers library, and additional modules are delivered and executed in memory as parsed COFF objects via a module_init routine (reflective loading, no additional payload written to disk). Neither second-stage IP returned an existing BeaconBeagle C2 correlation record at research time (queried 2026-09-18; both endpoints 404 — no prior beacon/config match on file), consistent with freshly rotated, purpose-built infrastructure rather than reused/shared C2.

A UAC-bypass stage relocates/respawns the binary as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe — masquerading as a legitimate Microsoft Edge telemetry component in a plausible ProgramData path — with a command-line flag that causes the respawned instance to skip the anti-sandbox checks performed on first run, and a beacon flag informs the C2 whether the host is a fresh or already-persistent install so the appropriate follow-on module is delivered. Public reporting does not disclose the specific UAC-bypass method (e.g., fodhelper/eventvwr-style) or a boot-persistence artifact (no registry Run key or scheduled task name has been published), only the relocation/masquerade and respawn behavior described above.

The final delivered module is a file-manager implant exposing 21 commands covering directory listing/enumeration, file read/upload/download, create/copy/move/rename/delete, permission (chmod-style) changes, symbolic-link creation, and file/image preview or thumbnail extraction — the last explicitly noted as supporting pre-exfiltration reconnaissance before an operator pulls specific files. Additional modules can be requested from C2 on demand.

The "The Odyssey" decoy filename tracks a real theatrical release (July 15, 2026), and Kaspersky frames the campaign as an evolution of the October 2025-origin activity, with incrementally improved detector/sandbox-evasion techniques observed over the roughly eleven-month window before the itorrents[.]org compromise was confirmed.

Kaspersky identified several hundred victims, both individuals and organizations, with infection attempts observed across Europe, Asia, and Africa, and corroborating reporting listing Russia, Turkiye, Japan, Kenya, Uganda, Colombia, Nepal, Tanzania, Ghana, Spain, the Netherlands, Belgium, Finland, and Germany (France notably absent from all reported victim lists); organizational victims spanned government, IT, consulting, retail, transportation, and agriculture sectors. No CVE applies — this is a social-engineering/supply-chain-style distribution-repository compromise, not a software vulnerability, and no threat-actor name or nation-state attribution has been published. One secondary aggregator (CraftedSignal) additionally attributed a registry-based UAC-bypass persistence technique and a "blockchain DGA" classification to MovieReaper; both are excluded here as unsupported by, and directly contradicted by, Kaspersky's primary Securelist research, which states explicitly that no registry Run key or scheduled-task artifact has been published and describes the Solana lookup as a dead-drop resolver rather than a domain-generation algorithm.

## MITRE ATT&CK

- T1608.001 Upload Malware
- T1195.002 Compromise Software Supply Chain
- T1204.002 Malicious File
- T1106 Native API
- T1027 Obfuscated Files or Information
- T1027.007 Dynamic API Resolution
- T1140 Deobfuscate/Decode Files or Information
- T1620 Reflective Code Loading
- T1036.005 Match Legitimate Resource Name or Location
- T1497 Virtualization/Sandbox Evasion
- T1548.002 Bypass User Account Control
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols
- T1132.001 Standard Encoding
- T1005 Data from Local System

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**MovieReaper Decoy Torrent Payload Execution (Loader Stage 1)** (`TL-2026-2560-SPL-001`)

Detects execution of the MovieReaper stage-1 loader delivered via the compromised itorrents.org repository: process creation matching a published sample hash, the "The Odyssey" decoy filename pattern, or an unsigned .exe spawned as a child of a torrent-client process from a Downloads/Temp working directory.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195.002, T1204.002
- **Data sources:** sysmon, windows_security, edr_process_telemetry
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval decoy_hash=if(match(Hashes, "(?i)(A0B13781EDD7CFDAB13D79AFFF3C83C1|4334BBAEA8DE33BF9D45E9B4E4E3BC2|4843F9FAFCAE492F11E2D4D33DBB4CDD|5310CABAE3FBE6DB8742849B588093F9|70060341CAF3338697A7DDFE0FB62875|AD4643EEA15AC286FA47D1131F9EF756|D0B967571AC8A3863C7F324BF5BDE99C|D88D550D0FB8E60CFFFF3EA61FF7A067)"), 1, 0)
| eval decoy_name=if(match(lower(Image), "the odyssey.*2026.*1080p.*webrip"), 1, 0)
| eval torrent_parent=if(match(lower(ParentImage), "(qbittorrent|utorrent|bittorrent|transmission-qt|deluge)\.exe"), 1, 0)
| where decoy_hash=1 OR decoy_name=1 OR (torrent_parent=1 AND match(lower(Image), "\.exe$") AND NOT match(lower(Image), "(program files|windows\\system32)"))
| table _time, ComputerName, User, ParentImage, Image, CommandLine, Hashes
| sort -_time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where MD5 in~ ("A0B13781EDD7CFDAB13D79AFFF3C83C1","4334BBAEA8DE33BF9D45E9B4E4E3BC2","4843F9FAFCAE492F11E2D4D33DBB4CDD","5310CABAE3FBE6DB8742849B588093F9","70060341CAF3338697A7DDFE0FB62875","AD4643EEA15AC286FA47D1131F9EF756","D0B967571AC8A3863C7F324BF5BDE99C","D88D550D0FB8E60CFFFF3EA61FF7A067")
    or (FileName has "the odyssey" and FileName has "2026" and FileName has "1080p")
    or (InitiatingProcessFileName in~ ("qbittorrent.exe","utorrent.exe","bittorrent.exe","transmission-qt.exe","deluge.exe") and FileName endswith ".exe" and not(FolderPath has_any ("Program Files","Windows\\System32")))
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, FolderPath, ProcessCommandLine, MD5
```

### Sigma

```yaml
title: MovieReaper Decoy Torrent Payload Execution
id: 7c1a2e4d-9b3f-4a2e-8e1c-1a2b3c4d5e6f
status: experimental
description: Detects execution of the MovieReaper stage-1 loader delivered via the compromised itorrents.org repository, matched by published sample hashes, the "The Odyssey" decoy filename, or an unsigned .exe spawned by a torrent client.
references:
    - https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/09/18
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.t1204.002
    - attack.tool.moviereaper
logsource:
    category: process_creation
    product: windows
detection:
    selection_hash:
        Hashes|contains:
            - 'A0B13781EDD7CFDAB13D79AFFF3C83C1'
            - '4334BBAEA8DE33BF9D45E9B4E4E3BC2'
            - '4843F9FAFCAE492F11E2D4D33DBB4CDD'
            - '5310CABAE3FBE6DB8742849B588093F9'
            - '70060341CAF3338697A7DDFE0FB62875'
            - 'AD4643EEA15AC286FA47D1131F9EF756'
            - 'D0B967571AC8A3863C7F324BF5BDE99C'
            - 'D88D550D0FB8E60CFFFF3EA61FF7A067'
    selection_decoy:
        Image|contains|all:
            - 'the odyssey'
            - '2026'
            - '1080p'
        Image|endswith: '.exe'
    selection_torrent_parent:
        ParentImage|endswith:
            - '\qbittorrent.exe'
            - '\utorrent.exe'
            - '\bittorrent.exe'
            - '\transmission-qt.exe'
            - '\deluge.exe'
        Image|endswith: '.exe'
        Image|contains:
            - '\Downloads\'
            - '\Temp\'
    condition: selection_hash or selection_decoy or selection_torrent_parent
falsepositives:
    - Legitimate torrent clients downloading unrelated executables (e.g., open-source software distributed via torrent)
level: high
```

**Known false positives:**

- Legitimate torrent clients downloading unrelated software distributed via magnet link/torrent

**Tuning notes:** Keep the published MD5 hash list current as Kaspersky/others release additional samples; the torrent-parent heuristic is broader and should be scoped to unsigned/uncommon publishers to reduce noise in environments where torrent clients are sanctioned.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- MovieReaper Minimal-Module-Load API Resolution Evasion (locked: unlock with TL Creds)
- MovieReaper Reflective COFF Module Load (No Disk Artifact) (locked: unlock with TL Creds)
- MovieReaper Disguised Image-Path Shellcode Staging Beacon (locked: unlock with TL Creds)
- MovieReaper Loader Sandbox/VM Environment Check (locked: unlock with TL Creds)
- MovieReaper Persistent Respawn With Anti-Sandbox-Skip Flag (locked: unlock with TL Creds)
- MovieReaper Second-Stage C2 Connection With File-Manager Recon Burst (locked: unlock with TL Creds)
- MovieReaper UAC Bypass & msedge.exe ProgramData Masquerade (locked: unlock with TL Creds)
- MovieReaper Solana Blockchain Dead-Drop C2 Resolution (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 22)

Defanged, TLP:CLEAR.

- IP address: `193.23.118[.]155`
- Domain: `deadhub[.]org`
- File hash: `A0B13781EDD7CFDAB13D79AFFF3C83C1`

Full set of 22 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana for C2](https://gbhackers.com/moviereaper-malware/)
- [MovieReaper: Trojan attack via movie torrents, including "The Odyssey"](https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344/)
- [MovieReaper Turns Movie Torrents Into Remote File Access](https://blog.gridinsoft.com/moviereaper-torrents-solana-malware/)
- [iTorrents.org compromised to spread a Windows malware loader instead of movies](https://www.it-connect.tech/itorrents-org-compromised-to-spread-a-windows-malware-loader-instead-of-movies/)
- [MovieReaper Torrent Trojan and Solana C2 Analysis](https://blog.netmanageit.com/moviereaper-torrent-trojan-solana-c2-analysis/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2560