Malware

MovieReaper

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1584.004ServerEvidence1

Злоумышленники взломали широко используемый публичный репозиторий торрент-файлов — itorrents[.]org; трекеры, полагающиеся на этот репозиторий, начали непреднамеренно распространять вредоносные торрент-файлы.

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence2

The threat actors did not compromise the torrent trackers themselves. Instead, they compromised a widely used public repository of torrent files — itorrents[.]org.

Execution

2 techniques

T1106Native APIEvidence3

Вредоносное ПО избегает вызовов LoadLibrary и GetProcAddress... выполняет ручной парсинг загруженной DLL для вычисления адреса функции... выполняет напрямую системный вызов NtProtectVirtualMemory ... Затем вызывает недокументированную функцию ntdll EtwpCreateEtwThread.

T1204.002Malicious FileEvidence3

After the user manually starts the application, it establishes a global mutex to ensure that only one loader is executed at a time.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence3

Stage 3 performs UAC Bypass and achieves persistence using public techniques.

Stealth

7 techniques

T1027Obfuscated Files or InformationEvidence2

The malware itself is not heavily obfuscated, apart from the fact that strings are encrypted with a custom stream cipher.

T1027.007Dynamic API ResolutionEvidence1

The malware avoids making LoadLibrary and GetProcAddress calls ... Instead, it searches for loaded libraries ... and then performs manual parsing of loaded DLL to calculate the address of function.

T1036MasqueradingEvidence3

Исполняемый файл маскируется с помощью длинного имени файла и иконки известного приложения, например VLC; длинные имена предположительно скрывают расширение «.exe» в конце.

T1036.005Match Legitimate Resource Name or LocationEvidence2

Стадия 3 ... маскирует исходный бинарный файл под C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe и перезапускает себя.

T1036.007Double File ExtensionEvidence1

Most of the filenames are rather large, presumably, to hide the '.exe' extension at the end.

T1497Virtualization/Sandbox EvasionEvidence3

Исполняемый файл выполняет ряд операций, чтобы избежать обнаружения антивирусными песочницами... Большинство контрмер были направлены на избежание обнаружения антивирусными песочницами.

T1620Reflective Code LoadingEvidence3

[The loader downloads] the shellcode, map it into the RWX memory and execute... the most important [command] parses the COFF file and loads it to the memory, and executes the module_init function from it.

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence3

The final module ('file manager') ... allows remote operator to ... list and enumerate directories. | [The file manager] allows remote operator to download, upload, read files on the system, list and enumerate directories.

T1497Virtualization/Sandbox EvasionEvidence3

Collection

1 technique

T1005Data from Local SystemEvidence3

[The final module can] use preview and thumbnail commands to exfiltrate previews of images and files before actually extracting them.

Command and Control

6 techniques

T1071.001Web ProtocolsEvidence3

The second stage of this malware performs an HTTPS request to the Solana blockchain at the /getAccountInfo endpoint... The second stage payload communicates with its C2 server strictly through HTTPS.

T1102Web ServiceEvidence1

[The campaign] leverages the legitimate Solana blockchain via the api.mainnet.solana.com RPC endpoint to deliver the address of the second-stage C2 server.

T1102.001Dead Drop ResolverEvidence2

Вторая стадия выполняет HTTPS-запрос к блокчейну Solana по эндпоинту /getAccountInfo... поле data содержит base64-кодированный адрес второго C2, зашифрованный статическим XOR-ключом.

T1105Ingress Tool TransferEvidence3

[The loader] perform[s] network connection to a C2 web-server to download the shellcode... [and] uses them as a path in the HTTP request to download parts of a shellcode.

T1573Encrypted ChannelEvidence1

The second stage payload communicates with its C2 server strictly through HTTPS via TLS-pinned certificate.

T1573.001Symmetric CryptographyEvidence1

Адрес второго C2 ... зашифрован статическим XOR-ключом... вторая стадия взаимодействует со своим C2-сервером строго через HTTPS с использованием закрепленного TLS-сертификата.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

The final module ... allows remote operator to download ... files ... [and] exfiltrate previews of images and files.

INDICATORS OF COMPROMISE

IOCs tracked for this family

16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.md5●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Sep 17, 2026

The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents - Malware News - Malware Analysis, News and Indicators

MovieReaper is a modular, multi-stage crimeware framework delivered by trojanized torrent downloads. Its loader evades sandbox analysis, downloads and executes shellcode in memory, retrieves second-stage C2 information from a Solana blockchain account, establishes persistence through a UAC bypass, and ultimately deploys a file-management implant that enables remote filesystem enumeration, upload, download, reading, modification, deletion, and preview/thumbnail exfiltration.

securelist ruNews

Sep 17, 2026

MovieReaper: троянская атака через торренты с фильмами, включая "Одиссею" | Securelist

Многоэтапный модульный crimeware-фреймворк, распространяемый через вредоносные торрент-загрузчики, маскируемые под фильмы. Его начальный загрузчик уклоняется от песочниц, получает shellcode с C2 по HTTP и запускает его в памяти. Вторая стадия использует Solana для получения адреса следующего C2, применяет HTTPS с закреплением TLS-сертификата и загружает COFF-модули. Последующие модули обходят UAC, обеспечивают закрепление и предоставляют файловый менеджер для удаленного просмотра, чтения, загрузки, выгрузки, изменения и эксфильтрации файлов.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching16

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

MovieReaper

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

21 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1584.004ServerEvidence1

Initial Access

1 technique

T1195Supply Chain CompromiseEvidence2

The threat actors did not compromise the torrent trackers themselves. Instead, they compromised a widely used public repository of torrent files — itorrents[.]org.

Execution

2 techniques

T1106Native APIEvidence3

T1204.002Malicious FileEvidence3

After the user manually starts the application, it establishes a global mutex to ensure that only one loader is executed at a time.

Privilege Escalation

1 technique

T1548.002Bypass User Account ControlEvidence3

Stage 3 performs UAC Bypass and achieves persistence using public techniques.

Stealth

7 techniques

T1027Obfuscated Files or InformationEvidence2

The malware itself is not heavily obfuscated, apart from the fact that strings are encrypted with a custom stream cipher.

T1027.007Dynamic API ResolutionEvidence1

The malware avoids making LoadLibrary and GetProcAddress calls ... Instead, it searches for loaded libraries ... and then performs manual parsing of loaded DLL to calculate the address of function.

T1036MasqueradingEvidence3

T1036.005Match Legitimate Resource Name or LocationEvidence2

Стадия 3 ... маскирует исходный бинарный файл под C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe и перезапускает себя.

T1036.007Double File ExtensionEvidence1

Most of the filenames are rather large, presumably, to hide the '.exe' extension at the end.

T1497Virtualization/Sandbox EvasionEvidence3

T1620Reflective Code LoadingEvidence3

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence3

T1497Virtualization/Sandbox EvasionEvidence3

Collection

1 technique

T1005Data from Local SystemEvidence3

[The final module can] use preview and thumbnail commands to exfiltrate previews of images and files before actually extracting them.

Command and Control

6 techniques

T1071.001Web ProtocolsEvidence3

The second stage of this malware performs an HTTPS request to the Solana blockchain at the /getAccountInfo endpoint... The second stage payload communicates with its C2 server strictly through HTTPS.

T1102Web ServiceEvidence1

[The campaign] leverages the legitimate Solana blockchain via the api.mainnet.solana.com RPC endpoint to deliver the address of the second-stage C2 server.

T1102.001Dead Drop ResolverEvidence2

T1105Ingress Tool TransferEvidence3

[The loader] perform[s] network connection to a C2 web-server to download the shellcode... [and] uses them as a path in the HTTP request to download parts of a shellcode.

T1573Encrypted ChannelEvidence1

The second stage payload communicates with its C2 server strictly through HTTPS via TLS-pinned certificate.

T1573.001Symmetric CryptographyEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

The final module ... allows remote operator to download ... files ... [and] exfiltrate previews of images and files.

INDICATORS OF COMPROMISE

IOCs tracked for this family

16 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

6 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.md5●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Sep 17, 2026

The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents - Malware News - Malware Analysis, News and Indicators

securelist ruNews

Sep 17, 2026

MovieReaper: троянская атака через торренты с фильмами, включая "Одиссею" | Securelist

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching16

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping21

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.