TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A report by security researcher Thereallo describes a South Park-named executable offered on public torrent trackers and automatically picked up by Sonarr. Analysis of the file found a hidden payload designed to collect credentials and other data, but the report does not independently establish how many people downloaded or ran it.
Security researcher Thereallo says a public torrent listing named as a South Park episode contained an executable that Sonarr automatically downloaded, and that analysis of the file revealed a hidden payload designed to steal credentials and other information. The account describes a potential risk to people who run the file themselves; it does not show that Sonarr executed it or establish how many users were affected.
In a report on Thereallo’s website, the researcher said Sonarr repeatedly tried to import the item after qBittorrent marked it complete. According to the account, qBittorrent recorded zero bytes downloaded, so the executable did not land on disk through that initial attempt. Thereallo said they later obtained the sample for analysis and blocklisted it in Sonarr, which also removed it from qBittorrent.
The researcher described the sample as a Windows x64 executable with a small program followed by a large amount of appended data. Their analysis found that the program extracted and decrypted a second executable hidden in that data, then loaded it in memory. Thereallo said the concealed payload targeted browser passwords, cookies and autofill data, cryptocurrency wallets, password managers, messaging and gaming accounts, developer credentials, remote-access tools and documents.
Thereallo also reported finding code intended to evade analysis, including anti-debugging and anti-sandbox checks, and said the stolen material was compressed and sent onward. The report describes a delivery address retrieved through online services, as well as a fallback address embedded in the sample. These technical findings are the researcher’s account; the supplied material includes no independent analysis from a security company or law-enforcement agency.
How a Fake Episode Creates Risk
The incident illustrates a distinction between automated media management and execution of a downloaded program. The researcher says Sonarr did not run the executable; the danger described is that someone later opens it from a downloads folder, believing it to be an episode. That could expose saved credentials, session cookies, wallet information and files to theft, according to the analysis.
People using public indexers may encounter misleading or malicious listings, but the report does not quantify their reach. The practical concern is not that every torrent download is known to contain this sample. It is that a familiar episode name and an automatic download workflow can put an unexpected executable in a place where a user might open it without checking its file type.
Thereallo recommended configuring qBittorrent to exclude executable and script extensions, removing suspicious downloads through Sonarr or Radarr, and reconsidering trackers that repeatedly supply such files. Those measures can reduce exposure to this kind of disguised file, though the report does not test their effectiveness across different configurations.
As an affiliate, we earn on qualifying purchases.
From Tracker Listing to Payload
Sonarr and Radarr organize and monitor television and film downloads, while Prowlarr can manage the indexers used to find them. In the account, the episode-named listing entered that automated workflow because its title matched a wanted item. The researcher said the file had an .exe extension, rather than a video file or a folder containing a purported video.
Thereallo reported that the sample’s main program read data appended to its own file, decrypted a second program and loaded it directly into memory. The report says the payload used encrypted strings and concealed imports, but that its configuration and embedded material could still be extracted through static analysis. The article’s account does not include a complete independent replication of each technical claim.
The report says the sample was built on October 6 and appeared on a torrent on October 8, with related online accounts or infrastructure registered on September 14. The supplied source does not specify the year for those dates, so they should not be treated as a verified current timeline. The researcher’s warning is directed at public-indexer users, especially anyone who might manually open an unexpected executable.
“Sonarr can’t run an exe, so it’s not the problem.”
— Thereallo, in the security report
As an affiliate, we earn on qualifying purchases.
Reach and Current Status Remain Unknown
The supplied report does not say how many trackers hosted the sample, how many people downloaded it, or whether anyone ran it and lost data. It also gives no confirmed victim count, incident response findings or evidence that a particular person’s information was stolen. The researcher’s technical conclusions are not accompanied in the supplied material by an independent assessment.
The report does not establish whether the torrent listing or the described delivery infrastructure remains active. Its dates lack a stated year in the source material, and no response from a tracker, software developer or security vendor is included. Readers should treat the malware behavior as the researcher’s reported findings, not as a confirmed account of infections at scale.
As an affiliate, we earn on qualifying purchases.
Safer Handling of Unexpected Downloads
Thereallo advised users to configure qBittorrent to exclude executable, shortcut and script file types, and to blocklist suspicious items in Sonarr or Radarr while removing them from the download client. The researcher also suggested demoting or removing an indexer that repeatedly supplies suspicious files. Users who find an unexpected executable should avoid opening it and can remove it from their download workflow.
The source report does not announce a tracker takedown, a fix to Sonarr, or a formal investigation. Until more information is available, the immediate precaution is to check file extensions before opening downloaded content and to keep credentials and devices protected. Whether the sample has affected users or remains available on public trackers is still unknown.
As an affiliate, we earn on qualifying purchases.
Key Questions
Did Sonarr run the executable?
No such execution is reported. Thereallo says Sonarr tried to import the item, but the risk described is that a person might later open the downloaded executable.
What information did the payload reportedly target?
Thereallo said it included code targeting browser credentials and cookies, cryptocurrency wallets, password managers, messaging and gaming accounts, developer credentials, remote-access applications and documents. These are findings attributed to the researcher, not independently verified here.
How many people were affected?
The report provides no victim or infection count. It does not establish whether anyone ran the file or had data stolen.
What precautions did the researcher recommend?
Thereallo recommended excluding executable and script extensions in qBittorrent, removing suspicious downloads through Sonarr or Radarr, and reconsidering indexers that repeatedly provide such files. Avoid opening unexpected executables.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
