Torrent sites tamper with Sonarr setup
The gist
A blog post describes a fake South Park episode .exe on public trackers that Sonarr kept grabbing.
The write-up shows how download automation can pull malware, not video.
How it unfolded
- Oct 11, 2026A blog post by Thereallo describes a file named "South Park S29E03 1080p WEB H264-MeGusta.exe" on public trackers with 2,392 seeders; Sonarr grabbed it and failed to import it every 90 seconds with the error "Import failed, path does not exist or is not accessible by Sonarr".
- Oct 11, 2026The author blocklisted the file in Sonarr, then re-downloaded it to analyze it; it is a real PE, x64 GUI, with the actual program 118 KB and 886 MB of random junk appended.
- Oct 11, 2026Analysis found the 118 KB program uses XOR obfuscation, a ChaCha20-encrypted payload in the junk, and a second 929 KB PE that dumps modules named osinfo, browsers, telegram, wallets, discord, steam, clipboard, remoteaccess, credentialmanager, authy, notes, obs, ssh, email, games and filegrabber.