Someone on Torrent Sites Kept Fucking with My Sonarr

I run the normal * arr stack on my NAS. It typically works simply great, till I saw a caution on my control panel.

The brand-new South Park episode was stuck in the line with:

WHO is really succumbing to this in the huge 2026????

Let me really clear about what this is.

Somebody took a South Park EP name, put .exe on completion, and submitted it to public trackers with 2,392 seeders,???

Who is dropping episodes as an EXE????

And Sonarr got it, due to the fact that of course it did. It sat there attempting to import it every 90 fucking seconds:

Not even a folder with a phony .mkv and a “codec installer” beside it like the “good old days”

Simply the exe. Are we deadass.

qBittorrent marked it “finished” 2 seconds after including it with total_downloaded: 0so absolutely nothing really arrived at disk. No concept why. Do not care. Thanks qBit.

I blocklisted it in Sonarr, which nukes it from qBittorrent and stops it getting the exact same scrap skid malware once again.

I downloaded it once again on function. Due to the fact that now I’m pissed and I would like to know what’s within.

It’s a genuine PE, x64 GUI. The real program is 118 KB

The other 886 MB is random scrap glued onto completion. Why? Since a great deal of scanners simply quit on files that huge.

The variation details states:

“Freeware Developers.” my ass

I sliced the 118 KB off the front and tossed it into IDA, due to the fact that I’m not filling a gigabyte of bullcrap into anything. The whole thing is covered in this:

XOR a worldwide. XOR it back. Not do anything. Numerous times.

It exists simply to make the decompiler output appear like shit, and it does, congrats.

Strip all that out and the reasoning resembles 6 actions:

1. Open its own file.
2. Check out the last 64 bytes.
3. Utilize those to discover and decrypt a payload concealed in the scrap.
4. Map it as a PE in memory by hand.
5. Point PEB->ImageBaseAddress at it.
6. Dive in.

Absolutely nothing touches disk. Including all that obfuscation for 6 actions.

The last 64 bytes of the file are the entire config: