MovieReaper: How Torrent Files Hide a Modular Trojan
Securelist details MovieReaper, a multi-stage Windows Trojan distributed through compromised torrent files and using Solana to conceal its C2.
Movie torrents have become the delivery mechanism for a Windows malware framework that combines familiar social engineering with less conventional command-and-control infrastructure. In research published by Securelist, Kaspersky’s research publication, the campaign is described as distributing a previously unknown, modular Trojan that the researchers named MovieReaper.
The campaign begins with a compromised torrent-file repository and a user who believes they are downloading a film. It then progresses through in-memory execution, shellcode retrieval, a blockchain lookup for the next command server, persistence, and a file-management module. Securelist says it identified several hundred victims, including individuals and organizations in countries across Europe, Asia, and Africa.
The findings matter for more than torrent users. The framework’s modular design, use of legitimate blockchain infrastructure, and reliance on memory-resident components create detection challenges for organizations whose users download unauthorized media, software, or other content. At the same time, the early stages expose practical opportunities for blocking and investigation.
What Securelist confirmed
Securelist traced the initial distribution to malicious torrent files hosted through the public repository itorrents[.]org. According to the research, the attackers did not compromise each torrent-tracking site individually. Instead, they compromised the shared repository used by multiple trackers. When a user followed a magnet link, the expected torrent archive could be replaced with a different torrent file that led to the malware loader.
The campaign used movie-themed filenames, including a sample named the odyssey (2026) [1080p] [webrip] [5.1].exe. Securelist observed multiple loader names and application-like icons. The researchers noted that long filenames may have been intended to obscure the executable extension. Execution still required the user to manually start the downloaded file.
Kaspersky products detect the threat as HEUR:Trojan.Win64.Agent.gen. Securelist also reported that the campaign was active during its investigation and that the underlying torrent repository remained compromised at the time of publication. Those observations describe the research window; they should not be treated as evidence that the infrastructure remains active now.
How the infection chain unfolds
MovieReaper is organized as a staged framework. The loader is the principal component initially written to disk. Later elements are obtained and executed in memory, reducing the number of persistent artifacts available to traditional file-based scanning.
1. The loader
After launch, the loader creates a global mutex so that only one copy runs at a time. Securelist observed mutex values including Global\fnulSktzSqvVLXHU and Global\E4AyDKzvEhe2hgAr. The loader then performs checks designed to complicate automated analysis in antivirus sandboxes and virtual machines.
Rather than relying directly on common Windows API-resolution calls, the sample searches loaded libraries through the Process Environment Block and manually parses DLL data to locate required functions. Securelist also observed exception-handler manipulation and use of a system-call instruction before memory protection was changed for code execution. The loader ultimately maps downloaded shellcode into executable memory and runs it.
The first-stage component contacts deadhub[.]org over HTTPS. If that connection fails, the research identifies 193[.]23[.]118[.]155 as a fallback reached over plain HTTP. The loader requests shellcode in parts, using paths that resemble image or cloud-storage resources, such as /cloud/v192.4/ui/sync-status-icons.png. These paths do not indicate that the files are legitimate images; they are request patterns observed by the researchers.
2. Shellcode and the Solana lookup
The shellcode provides the framework’s unusual infrastructure feature. It sends an HTTPS request to the Solana blockchain’s public RPC service, api[.]mainnet[.]solana[.]com, querying the account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm. The response contains a base64-encoded value holding the address of another command-and-control server. Securelist says that value is encrypted with a static XOR key embedded in the shellcode.
The researchers also identified a Solana program at CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL that the attackers used to store data in the account. In practical terms, the blockchain acts as a distribution layer for the next C2 address rather than as the primary channel for all malware traffic.
This design changes the defender’s blocking problem. A conventional C2 address can be blocked or taken down, but a malware sample that retrieves its next endpoint from a public blockchain service can receive updated infrastructure without changing its initial delivery server. Securelist assesses that this gives the campaign additional resilience against straightforward IP-based disruption.
3. The second-stage implant
After obtaining the next server address, the second-stage component communicates with it over HTTPS. Securelist observed TLS certificate pinning and the use of the nanopb protobuf library as a container for exchanged data.
The implant can receive commands that parse a COFF file, load it into memory, and execute its module_init function. This provides an extension mechanism for additional modules. Securelist reported that several recovered modules contained symbols, which helped the researchers analyze them, but the presence of symbols in those samples should not be interpreted as a general characteristic of every campaign component.
4. UAC bypass and persistence
A later module performs a User Account Control bypass using public techniques and establishes persistence. It masquerades as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe, then restarts the process.
The restarted copy uses a special command-line argument that allows it to skip most of the initial anti-sandbox checks and proceed to the next-stage download. A flag in the beacon tells the remote server whether the implant is running from the Telemetry directory, allowing the C2 to distinguish an initial execution from a respawned instance.
The research does not identify the exact public UAC-bypass technique used. That detail remains unspecified in the supplied findings, so defenders should avoid assuming a particular Windows component or registry path without validating it against endpoint evidence.
5. The final file-management module
The final module Securelist recovered is described as a file manager with 21 commands. Its reported functions include listing directories, reading and transferring files, creating, copying, renaming, moving, and deleting files, and creating symbolic links. It can also generate previews and thumbnails of images and other files before those items are extracted.
Securelist suspects that additional modules may be delivered on demand, but that possibility was not confirmed as an observed capability in the supplied report. The confirmed file-management functions nevertheless give an operator meaningful access to data on an infected host.
Victims, infrastructure, and attribution limits
Securelist reported infections and infection attempts affecting both individuals and organizations. Countries named in the research include Russia, Spain, Germany, Finland, Türkiye, Japan, Nepal, Kenya, Tanzania, Ghana, and others. The affected organizational sectors included enterprise, government, IT, consulting, retail, transportation, and agriculture.
The supplied research does not assign MovieReaper to a named threat actor or nation-state. Securelist does assess that activity by the same actor dates back to October 2025 and that the campaign evolved over time, including changes intended to make the loader harder to detect. That is a research assessment, not a confirmed public attribution.
The second-stage C2 indicators listed by Securelist are 208[.]64[.]33[.]90 and 208[.]94[.]246[.]53. The researchers describe the infrastructure as using commercial hosting providers. Because infrastructure can be reassigned or change ownership, these indicators should support investigation and retrospective hunting rather than serve as the sole basis for permanent blocking.
What organizations should do now
- Block the delivery path. Restrict access to known malicious torrent repositories and discourage torrent-based software or media acquisition on business systems. Web filtering should account for both domain and IP indicators from the Securelist report, with the indicators defanged in documentation and safely converted within approved security tooling.
- Monitor suspicious executable launches. Hunt for long, media-themed executable filenames launched from user download locations, torrent clients, browsers, temporary directories, or removable media. Pay particular attention to files using familiar application icons while ending in
.exe. - Inspect memory and process behavior. EDR telemetry should flag unusual executable-memory allocation, shellcode downloaded by a newly launched user process, manual API resolution, exception-handler manipulation, and execution through uncommon thread-creation paths. These behaviors are more durable detection opportunities than filenames alone.
- Review outbound traffic. Investigate systems that contact
deadhub[.]org,193[.]23[.]118[.]155, the two listed second-stage IP addresses, or the Solana RPC endpoint in a sequence associated with suspicious process activity. A connection to Solana alone is not proof of infection because the service is legitimate and widely accessible. - Search for persistence artifacts. Examine endpoints for
%ProgramData%\Microsoft\Windows\Telemetry\msedge.exe, unexpected execution from that directory, related process respawns, and command lines containing the special argument described by Securelist. Validate any finding against file provenance and cryptographic evidence. - Use the supplied indicators carefully. The report lists eight MD5 hashes, including
A0B13781EDD7CFDAB13D79AFFF3C83C1, along with the mutexes and network indicators above. Add the full set to internal hunting and quarantine workflows, but do not rely on hashes alone because the framework is modular and its components may change. - Prepare for user-driven execution. Endpoint controls should prevent standard users from launching unapproved executables downloaded from torrent clients and similar sources. Security awareness should explain why pirated-content installers and instructions to disable antivirus protections are high-risk.
Incident responders should preserve the original executable, process lineage, command-line arguments, memory captures, DNS and proxy records, TLS metadata, and endpoint persistence evidence. Because later stages may execute only in memory, a disk-only review can miss important parts of the chain.
Conclusion
MovieReaper illustrates how a conventional torrent-based lure can be paired with a sophisticated delivery framework. Securelist’s findings show a progression from a malicious torrent file to a loader, downloaded shellcode, a blockchain-mediated C2 lookup, persistent execution, and a modular file-management capability.
The Solana component does not make the campaign impossible to disrupt. The first-stage server remains a valuable intervention point, while endpoint behavior, process telemetry, persistence checks, and user-download controls can expose activity even when later C2 infrastructure changes. Organizations should treat the named indicators as investigation aids and focus their longer-term defenses on the execution and memory behaviors that define the framework.