A Fake South Park .exe with 2,392 Seeders Hit My Sonarr
Someone on Torrent Sites Kept Fucking with My Sonarr
A fake South Park episode—a 118 KB .exe padded with 886 MB of junk—landed on public trackers with 2,392 seeders and got grabbed by Sonarr. I tore it apart: ChaCha20-encrypted payload, AES-CTR strings, anti-debug tricks, and a full infostealer targeting browsers, crypto wallets, password managers, Telegram, Discord, and dev credentials. The C2 address was hardcoded anyway. Here's how to block it.
And to whoever made this: you probably spent weeks or shit ton of tokens on ChaCha20, AES-CTR, runtime API hashing, anti sandbox scoring, Chrome app bound encryption bypasses, just to make a shitty skid malware. Get a job.