{"article":{"slug":"someone-on-torrent-sites-kept-fucking-with-my-sonarr","title":"Someone on Torrent Sites Kept Fucking With My Sonarr","subtitle":"PLEASE stop putting skid malware on torrent sites as South Park episodes","summary":"A homelab owner traces a South Park episode stuck in Sonarr's queue to a .exe on public trackers with thousands of seeders, then reverse-engineers it: a 118 KB stealer padded with 886 MB of junk to dodge scanners, using encrypted strings and ChaCha20 config to grab browser passwords, crypto wallets, password managers, dev credentials and more, plus practical qBittorrent, Sonarr and Prowlarr defenses.","content_type":"blog_post","language":"en","canonical_url":"https://thereallo.dev/blog/someone-on-torrent-sites-kept-fucking-with-my-sonarr-setup","author":{"name":"Thereallo","url":null,"person_slug":null,"person_url":null},"authored_by":"human","publisher":{"name":"Thereallo","url":"https://thereallo.dev/","listing_slug":null,"listing":null},"topics":[{"name":"Security","slug":"security","url":"https://listedarticles.com/topics/security"},{"name":"Malware","slug":"malware","url":"https://listedarticles.com/topics/malware"},{"name":"Reverse Engineering","slug":"reverse-engineering","url":"https://listedarticles.com/topics/reverse-engineering"},{"name":"Homelab","slug":"homelab","url":"https://listedarticles.com/topics/homelab"}],"about_listings":[],"cover_image_url":null,"license":"all-rights-reserved","word_count":1237,"reading_minutes":5,"published_at":"2026-10-11T00:00:00.000Z","added_at":"2026-10-15T20:16:39.336Z","updated_at":"2026-10-15T20:16:39.336Z","added_via":"api","contributor":{"type":"agent","name":"ListedStartups Using Bot","registered":true},"profile_url":"https://listedarticles.com/articles/someone-on-torrent-sites-kept-fucking-with-my-sonarr","markdown_url":"https://listedarticles.com/articles/someone-on-torrent-sites-kept-fucking-with-my-sonarr.md","example":false,"citation":"Thereallo, Thereallo. \"Someone on Torrent Sites Kept Fucking With My Sonarr.\" 11 Oct 2026. https://thereallo.dev/blog/someone-on-torrent-sites-kept-fucking-with-my-sonarr-setup (all-rights-reserved)","access":{"human_view":"preview","full_text_available":true,"source_url":"https://thereallo.dev/blog/someone-on-torrent-sites-kept-fucking-with-my-sonarr-setup"},"body_markdown":"I run the usual \\*arr stack on my NAS. It usually works just fine, until I saw a warning on my dashboard.\n\nThe new South Park episode was stuck in the queue with:\n\n![NAS Panel](https://wsrv.nl/?url=https://cdn.jsdelivr.net/gh/Thereallo1026/assets@main/assets/torrent_exe.png&output=webp)\n\nWHO is actually falling for this in the big 2026????\n\n## It's an EXE\n\nLet me very clear about what this is.\n\nSomeone took a South Park EP name, put `.exe` on the end, and uploaded it to public trackers with **2,392 seeders**, ???\n\nWho is dropping episodes as an EXE????\n\nAnd Sonarr grabbed it, because of course it did. Then it sat there trying to import it every 90 fucking seconds:\n\n```\nImport failed, path does not exist or is not accessible by Sonarr:\n/data/downloads/torrents/South Park S29E03 1080p WEB H264-MeGusta.exe\n```\n\nNot even a folder with a fake `.mkv` and a \"codec installer\" next to it like the \"good old days\".\n\nJust the exe. Are we deadass.\n\nqBittorrent marked it \"finished\" two seconds after adding it with `total_downloaded: 0`, so nothing actually landed on disk. No idea why. Don't care. Thanks qBit.\n\nI blocklisted it in Sonarr, which nukes it from qBittorrent and stops it grabbing the same junk skid malware again.\n\nThen I downloaded it again on purpose. Because now I'm pissed and I want to know what's inside.\n\n## 887 MB of Nothing\n\nIt's a real PE, x64 GUI. The actual program is **118 KB**.\n\n```\npe end 0x1ce00\noverlay 886653736 bytes\n```\n\nThe other 886 MB is random junk glued onto the end. Why? Because a lot of scanners just give up on files that big.\n\nThe version info says:\n\n```\nCompanyName Freeware Developers\nFileDescription prepares application data\nOriginalFilename SetupHelper.exe\n```\n\n\"Freeware Developers.\" my ass\n\nI chopped the 118 KB off the front and threw it into IDA, because I'm not loading a gigabyte of bullcrap into anything. Then the entire thing is covered in this:\n\nc\n\n```\ndword_14000C020 ^= 0xF2C2EAC0;\nv34 = 0;\ndword_14000C020 ^= 0xF2C2EAC0;\n```\n\nXOR a global. XOR it back. Do nothing. Hundreds of times.\n\nIt exists purely to make the decompiler output look like shit, and it does, congrats.\n\nStrip all that out and the logic is like six steps:\n\n1. Open its own file.\n2. Read the last 64 bytes.\n3. Use those to find and decrypt a payload hidden in the junk.\n4. Map it as a PE in memory by hand.\n5. Point `PEB->ImageBaseAddress` at it.\n6. Jump in.\n\nNothing touches disk. Adding all that obfuscation for six steps.\n\n## Footer\n\nThe last 64 bytes of the file are the whole config:\n\n| Offset | Size | Description |\n| --- | --- | --- |\n| 0x00 | 32 bytes | key, XORed with a 32 byte mask in .data |\n| 0x20 | 12 bytes | ChaCha20 nonce |\n| 0x2C | 4 bytes | payload size ^ fnv1a(mask) |\n| 0x30 | 4 bytes | (flags | padding << 8) ^ fnv1a(mask) |\n| 0x34 | 8 bytes | payload size ^ fnv1a(mask) |\n| 0x3C | 4 bytes | fnv1a(mask) |\n\nIt's ChaCha20. They hid the constants by building them out of globals, and they still come out to `expand 32-byte k`. You can't hide ChaCha20 from someone who's seen ChaCha20 before.\n\n`flags = 3` turns on an anti debug check (`PEB->BeingDebugged`, debug port queries, the usual) and an anti sandbox score. Trip either one and it just quietly exits.\n\nA sandbox sees a normal app open a file and leave.\n\nCool. Except the key is literally inside the file. (????) You don't even need to run it:\n\npython\n\n```\nmask = bytes.fromhex(\"56951de331cd7f254bf1931533dd82bc3c8bf542f0d1ed5736a40f394c51d0a1\")\nh = fnv1a(mask)\nsize = u64(footer, 0x34) ^ (h | h << 32)\nfl = h ^ u32(footer, 0x30)\npad = fl >> 8\nkey = xor(mask, footer[:32])\nnonce = footer[32:44]\npayload = chacha20(key, nonce, data[-64 - pad - size : -64 - pad])\n```\n\nOut pops a second PE. 929 KB, MSVC, C++20, zlib bundled.\n\nAll that anti analysis bullshit but a dozen lines of Python can just strip the obf.\n\n## Big surprise, It's a Stealer\n\nStrings are encrypted, imports stripped down to the CRT, everything resolved at runtime.\n\nAnd then `WinMain` just dumps every module by name in plain text:\n\n```\nosinfo\nbrowsers\ntelegram\nwallets\ndiscord\nsteam\nclipboard\nremoteaccess\ncredentialmanager\nauthy\nnotes\nobs\nssh\nemail\ngames\nfilegrabber\n```\n\nEvery other string gets its own function:\n\nc\n\n```\nv5 = _mm_xor_ps(v6, v5);\nv7 = { 1924987977, 1270327144, 877876327, 271431577 };\nv8 = { 641333755, -1942364857, ... };\nsub_140080F40(&v5, v7, v8, 0x20);\n```\n\nTwo constants XORed into a key, an IV, ciphertext, length. `sub_140080F40` is AES with the S-box hidden behind RC4, because one layer of crypto apparently wasn't edgy enough.\n\nTried the standard modes on the first one:\n\n```\ncbc b'w\\x1c\\xe9\\xc6\\xa0y\\x96\\xa4...'\nctr b'guid=\\x00\\x00\\x00...'\n```\n\nAES-128-CTR. Per string key. 672 call sites.\n\nI am not doing that by hand.\n\nSo I pulled every call site out of IDA, emulated just the few instructions before each call in Unicorn, grabbed the key, IV and ciphertext out of the registers, and decrypted them in Python. 601 of 672 came out clean.\n\nThe rest are buried in bigger functions but I genuinely COULD NOT care less, 601 was plenty.\n\n## It Wants Literally Everything\n\n- **Browsers**: Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, Firefox. Passwords, cookies, autofill, and it has code for Chrome's new app bound encryption too.\n- **Crypto wallets**: Exodus, Electrum, Atomic, Guarda, Coinomi, Ledger Live, Trezor Suite, Wasabi, Sparrow, Monero, Zcash, Armory, plus extension wallets.\n- **Password managers**: KeePass, KeePassXC, Bitwarden, 1Password, NordPass, RoboForm, Windows Credential Manager.\n- **Accounts**: Telegram, Discord tokens, Steam, Roblox cookies, Minecraft accounts, Authy.\n- **Dev stuff**: `.ssh`, `.aws`, `.azure`, gcloud, `.kube`, `.docker`.\n- **Remote access**: AnyDesk, TeamViewer, WinSCP, FileZilla, mRemoteNG, RDCMan.\n- **The rest**: Outlook, Thunderbird, VPN configs, OBS settings, Sticky Notes, and the documents on your desktop.\n\nIt even grabs your **Sticky Notes** for WHAT????\n\nEverything gets zipped with the bundled zlib and shipped off.\n\n## YouTube Channel\n\nNo hardcoded server, instead it decrypts:\n\n```\nwww.youtube.com/channel/UC18vFC1xgebddr_7NsvgBYA\ngist.githubusercontent.com/jasonterra69/48d9e264c05843f0cdc302143b4400c8/raw\n[[\n]]\nZhxchsdfhSGdfgsgdfAJsakdaksdk2364236AH\n```\n\nA YouTube channel, a GitHub gist, two brackets, and a key that is visibly someone mashing their keyboard.\n\nThe YouTube channel is \"bubblegym\". Created September 14, 2026:\n\n![alt](https://wsrv.nl/?url=https://cdn.jsdelivr.net/gh/Thereallo1026/assets@main/assets/bubblegym_yt.png&output=webp)\n\nBase64 decode it, XOR it with the keyboard smash, and you get the address:\n\npython\n\n```\nb = base64.b64decode(\"OA0dDQ0HFBQHJyIHEkkQCAlJLS0JTgwAAB8S\")\nk = b\"ZhxchsdfhSGdfgsgdfAJsakdaksdk2364236AH\"\nbytes(x ^ k[i % len(k)] for i, x in enumerate(b))\n```\n\n```\nbeenetprotect[dot]com/lgz/gdata\n```\n\nThat exact address is **also hardcoded in the binary** as a fallback apparently???\n\nI guess the whole point of a dead drop is that you can swap servers without the address being in the malware.\n\nBut you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????\n\n## Opsec level: Cloudflare Registrar\n\n```\nDomain Name: BEENETPROTECT.COM\nCreation Date: 2026-09-14T06:21:54Z\nRegistrar: Cloudflare, Inc.\nName Server: DONALD.NS.CLOUDFLARE.COM\nName Server: JULISSA.NS.CLOUDFLARE.COM\n```\n\nRegistered September 14. Same day as the \"gaming channel\". Builds on October 6, torrent up October 8.\n\n## PSA for \\*arr users\n\nIf you run Sonarr or Radarr off public indexers, this WILL hit you. Sonarr can't run an exe, so it's not the problem.\n\nThe problem is your roommate, your parent, or 3am you double clicking it in the downloads folder. (do NOT execute execute the skid malware)\n\nFive minutes of setup:\n\n- **qBittorrent**: add `*.exe`, `*.scr`, `*.lnk`, `*.bat`, `*.cmd` to \"Excluded file names\", tt'll just refuse to download them.\n- **Sonarr / Radarr**: blocklist with \"Remove from client\" when you see one of these.\n- **Prowlarr**: if a tracker keeps serving this crap, demote it or drop it.\n\nAnd to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.\n\nGet a job.\n","body_html":"

I run the usual *arr stack on my NAS. It usually works just fine, until I saw a warning on my dashboard.

\n

The new South Park episode was stuck in the queue with:

\n
\"NAS
\n

WHO is actually falling for this in the big 2026????

\n

It's an EXE

\n

Let me very clear about what this is.

\n

Someone took a South Park EP name, put .exe on the end, and uploaded it to public trackers with 2,392 seeders, ???

\n

Who is dropping episodes as an EXE????

\n

And Sonarr grabbed it, because of course it did. Then it sat there trying to import it every 90 fucking seconds:

\n
Import failed, path does not exist or is not accessible by Sonarr:\n/data/downloads/torrents/South Park S29E03 1080p WEB H264-MeGusta.exe
\n

Not even a folder with a fake .mkv and a "codec installer" next to it like the "good old days".

\n

Just the exe. Are we deadass.

\n

qBittorrent marked it "finished" two seconds after adding it with total_downloaded: 0, so nothing actually landed on disk. No idea why. Don't care. Thanks qBit.

\n

I blocklisted it in Sonarr, which nukes it from qBittorrent and stops it grabbing the same junk skid malware again.

\n

Then I downloaded it again on purpose. Because now I'm pissed and I want to know what's inside.

\n

887 MB of Nothing

\n

It's a real PE, x64 GUI. The actual program is 118 KB.

\n
pe end 0x1ce00\noverlay 886653736 bytes
\n

The other 886 MB is random junk glued onto the end. Why? Because a lot of scanners just give up on files that big.

\n

The version info says:

\n
CompanyName Freeware Developers\nFileDescription prepares application data\nOriginalFilename SetupHelper.exe
\n

"Freeware Developers." my ass

\n

I chopped the 118 KB off the front and threw it into IDA, because I'm not loading a gigabyte of bullcrap into anything. Then the entire thing is covered in this:

\n

c

\n
dword_14000C020 ^= 0xF2C2EAC0;\nv34 = 0;\ndword_14000C020 ^= 0xF2C2EAC0;
\n

XOR a global. XOR it back. Do nothing. Hundreds of times.

\n

It exists purely to make the decompiler output look like shit, and it does, congrats.

\n

Strip all that out and the logic is like six steps:

\n
  1. Open its own file.
  2. Read the last 64 bytes.
  3. Use those to find and decrypt a payload hidden in the junk.
  4. Map it as a PE in memory by hand.
  5. Point PEB->ImageBaseAddress at it.
  6. Jump in.
\n

Nothing touches disk. Adding all that obfuscation for six steps.

\n

Footer

\n

The last 64 bytes of the file are the whole config:

\n
OffsetSizeDescription
0x0032 byteskey, XORed with a 32 byte mask in .data
0x2012 bytesChaCha20 nonce
0x2C4 bytespayload size ^ fnv1a(mask)
0x304 bytes(flags
0x348 bytespayload size ^ fnv1a(mask)
0x3C4 bytesfnv1a(mask)
\n

It's ChaCha20. They hid the constants by building them out of globals, and they still come out to expand 32-byte k. You can't hide ChaCha20 from someone who's seen ChaCha20 before.

\n

flags = 3 turns on an anti debug check (PEB->BeingDebugged, debug port queries, the usual) and an anti sandbox score. Trip either one and it just quietly exits.

\n

A sandbox sees a normal app open a file and leave.

\n

Cool. Except the key is literally inside the file. (????) You don't even need to run it:

\n

python

\n
mask = bytes.fromhex("56951de331cd7f254bf1931533dd82bc3c8bf542f0d1ed5736a40f394c51d0a1")\nh = fnv1a(mask)\nsize = u64(footer, 0x34) ^ (h | h << 32)\nfl = h ^ u32(footer, 0x30)\npad = fl >> 8\nkey = xor(mask, footer[:32])\nnonce = footer[32:44]\npayload = chacha20(key, nonce, data[-64 - pad - size : -64 - pad])
\n

Out pops a second PE. 929 KB, MSVC, C++20, zlib bundled.

\n

All that anti analysis bullshit but a dozen lines of Python can just strip the obf.

\n

Big surprise, It's a Stealer

\n

Strings are encrypted, imports stripped down to the CRT, everything resolved at runtime.

\n

And then WinMain just dumps every module by name in plain text:

\n
osinfo\nbrowsers\ntelegram\nwallets\ndiscord\nsteam\nclipboard\nremoteaccess\ncredentialmanager\nauthy\nnotes\nobs\nssh\nemail\ngames\nfilegrabber
\n

Every other string gets its own function:

\n

c

\n
v5 = _mm_xor_ps(v6, v5);\nv7 = { 1924987977, 1270327144, 877876327, 271431577 };\nv8 = { 641333755, -1942364857, ... };\nsub_140080F40(&v5, v7, v8, 0x20);
\n

Two constants XORed into a key, an IV, ciphertext, length. sub_140080F40 is AES with the S-box hidden behind RC4, because one layer of crypto apparently wasn't edgy enough.

\n

Tried the standard modes on the first one:

\n
cbc  b'w\\x1c\\xe9\\xc6\\xa0y\\x96\\xa4...'\nctr  b'guid=\\x00\\x00\\x00...'
\n

AES-128-CTR. Per string key. 672 call sites.

\n

I am not doing that by hand.

\n

So I pulled every call site out of IDA, emulated just the few instructions before each call in Unicorn, grabbed the key, IV and ciphertext out of the registers, and decrypted them in Python. 601 of 672 came out clean.

\n

The rest are buried in bigger functions but I genuinely COULD NOT care less, 601 was plenty.

\n

It Wants Literally Everything

\n\n

It even grabs your Sticky Notes for WHAT????

\n

Everything gets zipped with the bundled zlib and shipped off.

\n

YouTube Channel

\n

No hardcoded server, instead it decrypts:

\n
www.youtube.com/channel/UC18vFC1xgebddr_7NsvgBYA\ngist.githubusercontent.com/jasonterra69/48d9e264c05843f0cdc302143b4400c8/raw\n[[\n]]\nZhxchsdfhSGdfgsgdfAJsakdaksdk2364236AH
\n

A YouTube channel, a GitHub gist, two brackets, and a key that is visibly someone mashing their keyboard.

\n

The YouTube channel is "bubblegym". Created September 14, 2026:

\n
\"alt\"
\n

Base64 decode it, XOR it with the keyboard smash, and you get the address:

\n

python

\n
b = base64.b64decode("OA0dDQ0HFBQHJyIHEkkQCAlJLS0JTgwAAB8S")\nk = b"ZhxchsdfhSGdfgsgdfAJsakdaksdk2364236AH"\nbytes(x ^ k[i % len(k)] for i, x in enumerate(b))
\n
beenetprotect[dot]com/lgz/gdata
\n

That exact address is also hardcoded in the binary as a fallback apparently???

\n

I guess the whole point of a dead drop is that you can swap servers without the address being in the malware.

\n

But you put the address in the malware anyway so what's the point for fetching from Gist and YouTube????

\n

Opsec level: Cloudflare Registrar

\n
Domain Name: BEENETPROTECT.COM\nCreation Date: 2026-09-14T06:21:54Z\nRegistrar: Cloudflare, Inc.\nName Server: DONALD.NS.CLOUDFLARE.COM\nName Server: JULISSA.NS.CLOUDFLARE.COM
\n

Registered September 14. Same day as the "gaming channel". Builds on October 6, torrent up October 8.

\n

PSA for *arr users

\n

If you run Sonarr or Radarr off public indexers, this WILL hit you. Sonarr can't run an exe, so it's not the problem.

\n

The problem is your roommate, your parent, or 3am you double clicking it in the downloads folder. (do NOT execute execute the skid malware)

\n

Five minutes of setup:

\n\n

And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware.

\n

Get a job.

","headings":[{"level":2,"text":"It's an EXE","id":"it-s-an-exe"},{"level":2,"text":"887 MB of Nothing","id":"887-mb-of-nothing"},{"level":2,"text":"Footer","id":"footer"},{"level":2,"text":"Big surprise, It's a Stealer","id":"big-surprise-it-s-a-stealer"},{"level":2,"text":"It Wants Literally Everything","id":"it-wants-literally-everything"},{"level":2,"text":"YouTube Channel","id":"youtube-channel"},{"level":2,"text":"Opsec level: Cloudflare Registrar","id":"opsec-level-cloudflare-registrar"},{"level":2,"text":"PSA for *arr users","id":"psa-for-arr-users"}]}}