TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A security researcher reports finding a malicious executable disguised as a South Park episode on public torrent trackers. The file reportedly contained a credential-stealing payload, but the report does not establish how many people downloaded or ran it. The researcher recommends blocking executable file types in qBittorrent and removing suspicious releases from download clients.
A security researcher says a fake South Park episode circulating on public torrent trackers was an executable containing a credential-stealing payload. The file was picked up by the researcher’s Sonarr setup, prompting an analysis that found code targeting browser data, passwords, cryptocurrency wallets and other files; the report does not say whether anyone ran it or suffered account theft.
In a report on the Thereallo blog, the researcher said Sonarr queued a file named to resemble a new South Park episode, but with .exe appended. The torrent listing reportedly showed 2,392 seeders. The researcher wrote that qBittorrent marked the download finished with zero bytes downloaded, so no executable file was saved in that initial attempt. They later downloaded it intentionally for analysis and said they did not run it.
The report describes a small Windows program attached to roughly 886 MB of junk data, which the researcher said could frustrate file scanners. Analysis reportedly revealed an encrypted payload that the loader extracted and mapped into memory. The researcher said the second-stage program included code to collect data from browsers, password managers, cryptocurrency wallets, messaging and gaming accounts, developer credentials and remote-access tools, then package the results for transmission.
The researcher also reported that the malware used anti-debugging and anti-sandbox checks and obtained a server address through online sources, while retaining a fallback address in the binary. These findings come from the researcher’s technical analysis; the article does not cite an independent validation, name a security vendor that confirmed the sample, or report a victim count.
How a Torrent Reaches Personal Data
The reported incident illustrates a risk for households using automated media download tools: software may select a release based on its name and availability, but automation does not make an executable safe. Sonarr itself does not run an episode file, according to the researcher. The danger described is that a person could later open the unexpected executable from a downloads folder.
If the payload works as described and is executed, its reported targets extend beyond media accounts to saved credentials, financial wallets and work-related access. The report does not establish that any data was actually stolen, but the breadth of the listed targets makes the distinction between downloading a suspicious file and running it important.
The researcher recommended configuring qBittorrent to exclude executable and script extensions, removing suspicious releases through Sonarr or Radarr, and reviewing or dropping trackers that repeatedly supply such files. Those steps may reduce exposure, but they do not verify that a particular torrent is safe.
As an affiliate, we earn on qualifying purchases.
From Queue Warning to Malware Analysis
The researcher said the alert appeared when a South Park episode remained stuck in the Sonarr queue. After blocklisting the release, which the report says also removed it from qBittorrent, they intentionally obtained the file again to inspect it. The write-up describes static analysis of the loader and its payload, including decrypting hundreds of encrypted strings to identify targeted applications.
The report says the loader used ChaCha20 to extract the payload and that the second stage used AES-128-CTR for encrypted strings. It also describes a YouTube channel and a GitHub gist as part of the infrastructure used to retrieve a server address. The source gives dates of September 14 for creation of the channel and registration of the relevant infrastructure, October 6 for malware builds, and October 8 for the torrent upload. These dates and technical details are presented by the researcher and have not been independently corroborated in the supplied material.
“Sonarr can’t run an exe, so it’s not the problem.”
— Thereallo, the researcher who published the report
credential theft protection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Victims and Distribution Remain Unknown
The report does not establish how many people downloaded or executed the file, whether the payload successfully sent stolen information, or whether any accounts were compromised. It also does not identify the operators, provide an independently confirmed tracker list, or say whether the reported infrastructure remains active. The researcher’s analysis is detailed, but the supplied source material contains no confirmation from a security company, law enforcement agency or affected service.
The report says the first qBittorrent attempt downloaded zero bytes, but that does not show what happened to other users or other copies. The malware’s presence in a torrent listing and its reported capabilities should not be treated as proof that every person who encountered it was infected.
As an affiliate, we earn on qualifying purchases.
Practical Steps for Torrent Users
The researcher advises excluding .exe, .scr, .lnk, .bat and .cmd files in qBittorrent, removing suspicious releases from the download client through Sonarr or Radarr, and reconsidering trackers that repeatedly list them. Users who find an unexpected executable should not open it. The source does not describe a confirmed cleanup tool or a tracker-wide removal action.
Further reporting would be needed to verify the sample and its infrastructure independently, determine whether the torrent was removed, and establish whether victims or affected services have been identified. Until then, the report’s findings remain attributed to the researcher, and the key immediate safeguard is to avoid executing unexpected media downloads.
As an affiliate, we earn on qualifying purchases.
Key Questions
What was found in the fake South Park torrent?
The researcher reports that a South Park-named Windows executable contained a loader and a second-stage program designed to collect credentials and other sensitive data. Those findings are from the researcher’s analysis and have not been independently confirmed in the supplied material.
Does Sonarr run downloaded executable files?
The researcher says Sonarr cannot run an .exe. The reported risk is that a user might later open the file manually from a downloads folder.
Did the report confirm that anyone was infected?
No. The report does not give a victim count or confirm that anyone executed the file, lost data or had an account compromised.
What precautions did the researcher recommend?
The researcher suggested excluding executable and script extensions in qBittorrent, removing suspicious releases through Sonarr or Radarr, and reviewing trackers that repeatedly provide suspicious files. Do not open an unexpected executable.
Source: hn
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
