Torrent Malware Hid a Stealer Behind 886MB of Junk
Original: Someone on Torrent Sites Kept Fucking with My Sonarr
Why This Matters
Public tracker malware increasingly targets automated tools like Sonarr, not just manual downloaders.
A homelab user found a fake South Park S29E03 episode (.exe, 2,392 seeders) queued by Sonarr. The 887MB file held 118KB of real malware—a ChaCha20-encrypted stealer—padded with random bytes to evade scanners.
A developer running the standard *arr stack on their NAS noticed Sonarr had grabbed what it thought was South Park S29E03 in 1080p—except the file was named with a .exe extension. It had 2,392 seeders on public trackers. qBittorrent flagged it as 'finished' with zero bytes downloaded, so nothing landed on disk, but Sonarr still hammered the import path every 90 seconds.
Out of frustration, the author downloaded it deliberately and cracked it open. The file is 887MB total: 118KB of real PE binary up front, followed by 886MB of random padding. The bloat exists specifically to choke scanners that bail out on large files. Version info reads 'Freeware Developers' and 'SetupHelper.exe.'
Stripping the junk and loading the actual code into IDA revealed heavy XOR-based anti-analysis obfuscation—hundreds of pointless XOR operations on globals to trash decompiler output. Under that noise: six steps. The binary opens itself, reads the last 64 bytes as a config footer, decrypts a hidden payload using ChaCha20 with a key stored inside the same file, manually maps the result as a PE in memory, and jumps in without touching disk. Anti-debug and anti-sandbox checks (PEB->BeingDebugged, debug port queries) cause it to silently exit if tripped.
The author wrote a dozen lines of Python to decrypt the payload without running the file at all—because the key is literally embedded in the footer. The decrypted second PE (929KB, MSVC, C++20) is a credential stealer.