I run the customary *arr stack on my NAS. It normally plant fair fine, until I saw a alert on my dashboard.
The new South Park event was stuck in the queue with:
WHO is really falling for this in the big 2026????
Let me extremely apparent concerning what this is.
Someone took a South Park EP name, put .exe on the end, and uploaded it to community trackers alongside 2,392 seeders, ???
Who is dropping episodes as an EXE????
And Sonarr grabbed it, since of way it did. Then it sat there trying to import it all 90 fucking seconds:
Not equal a directory alongside a counterfeit .mkv and a "codec installer" next to it akin the "good old days".
Just the exe. Are we deadass.
qBittorrent marked it "finished" two seconds following adding it alongside total_downloaded: 0, so nothing really landed on disk. No idea why. Don't care. Thanks qBit.
I blocklisted it in Sonarr, which nukes it from qBittorrent and stops it grabbing the identical junk skid malware again.
Then I downloaded it again on purpose. Because now I'm pissed and I desire to cognize what's inside.
It's a genuine PE, x64 GUI. The genuine program is 118 KB.
The another 886 MB is random junk glued onto the end. Why? Because a lot of scanners fair provision up on records that big.
The type info says:
"Freeware Developers." my ass
I cut the 118 KB off the forefront and threw it into IDA, since I'm not loading a gigabyte of bullcrap into anything. Then the complete item is covered in this:
XOR a global. XOR it back. Do nothing. Hundreds of times.
It exists purely to create the decompiler output appearance akin shit, and it does, congrats.
Strip all that out and the logic is akin six steps:
- Open its own file.
- Read the final 64 bytes.
- Use those to discover and decrypt a payload hidden in the junk.
- Map it as a PE in recollection by hand.
- Point PEB->ImageBaseAddress at it.
- Jump in.
Nothing touches disk. Adding all that obfuscation for six steps.
The final 64 bytes of the document are the entire config:
| Offset | Size | Description |
|---|---|---|
| 0x00 | 32 bytes | key, XORed alongside a 32 byte disguise in .data |
| 0x20 | 12 bytes | ChaCha20 nonce |
| 0x2C | 4 bytes | payload size ^ fnv1a(mask) |
| 0x30 | 4 bytes | (flags | padding << 8) ^ fnv1a(mask) |
| 0x34 | 8 bytes | payload size ^ fnv1a(mask) |
| 0x3C | 4 bytes | fnv1a(mask) |
It's ChaCha20. They hid the constants by construction them out of globals, and they motionless arrive out to develop 32-byte k. You can't conceal ChaCha20 from person who's seen ChaCha20 before.
flags = 3 turns on an anti debug inspect (PEB->BeingDebugged, debug harbor queries, the usual) and an anti sandbox score. Trip either one and it fair quietly exits.
A sandbox sees a normal app open a document and leave.
Cool. Except the key is exactly inner the file. (????) You don't equal need to run it:
Out pops a second PE. 929 KB, MSVC, C++20, zlib bundled.
All that anti inspection bullshit but a dozen lines of Python can fair band the obf.
Strings are encrypted, imports stripped downward to the CRT, everything resolved at runtime.
And afterward WinMain fair dumps all component by name in plain text:
Every another cord gets its own function:
Two constants XORed into a key, an IV, ciphertext, length. sub_140080F40 is AES alongside the S-box hidden rearward RC4, since one tier of crypto apparently wasn't edgy enough.
Tried the norm modes on the archetypal one:
AES-128-CTR. Per cord key. 672 call sites.
I am not doing that by hand.
So I pulled all call location out of IDA, emulated fair the few instructions before all call in Unicorn, grabbed the key, IV and ciphertext out of the registers, and decrypted them in Python. 601 of 672 came out clean.
The remainder are buried in bigger functions but I genuinely COULD NOT attention less, 601 was plenty.
- Browsers: Chrome, Edge, Brave, Opera, Opera GX, Vivaldi, Firefox. Passwords, cookies, autofill, and it has code for Chrome's new app border encryption too.
- Crypto wallets: Exodus, Electrum, Atomic, Guarda, Coinomi, Ledger Live, Trezor Suite, Wasabi, Sparrow, Monero, Zcash, Armory, affirmative expansion wallets.
- Password managers: KeePass, KeePassXC, Bitwarden, 1Password, NordPass, RoboForm, Windows Credential Manager.
- Accounts: Telegram, Discord tokens, Steam, Roblox cookies, Minecraft accounts, Authy.
- Dev stuff: .ssh, .aws, .azure, gcloud, .kube, .docker.
- Remote access: AnyDesk, TeamViewer, WinSCP, FileZilla, mRemoteNG, RDCMan.
- The rest: Outlook, Thunderbird, VPN configs, OBS settings, Sticky Notes, and the documents on your desktop.
It equal grabs your Sticky Notes for WHAT????
Everything gets zipped alongside the bundled zlib and shipped off.
No hardcoded server, alternatively it decrypts:
A YouTube channel, a GitHub gist, two brackets, and a key that is visibly person mashing their keyboard.
The YouTube conduit is "bubblegym". Created September 14, 2026:
Base64 decode it, XOR it alongside the keyboard smash, and you get the address:
That exact location is also hardcoded in the binary as a fallback apparently???
I conjecture the entire item of a deceased autumn is that you can toggle servers without the location being in the malware.
But you put the location in the malware anyhow so what's the item for fetching from Gist and YouTube????
Registered September 14. Same day as the "gaming channel". Builds on October 6, torrent up October 8.
If you run Sonarr or Radarr off community indexers, this WILL hit you. Sonarr can't run an exe, so it's not the problem.
The issue is your roommate, your parent, or 3am you twice clicking it in the downloads folder. (do NOT execute execute the skid malware)
Five minutes of setup:
- qBittorrent: add *.exe, *.scr, *.lnk, *.bat, *.cmd to "Excluded document names", tt'll fair refuse to download them.
- Sonarr / Radarr: blocklist alongside "Remove from client" whenever you see one of these.
- Prowlarr: if a tracker keeps serving this crap, demote it or autumn it.
And to whoever made this: you likely spent weeks or crap ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app border encryption bypasses, fair to create a shitty skid malware.
Get a job.
