Full Report
Kaspersky experts have discovered a new MovieReaper campaign. The multi-stage Trojan spreads through movie torrents, such as "The Odyssey," and uses the Solana blockchain to hide its C2 infrastructure.
Analysis Summary
# Tool/Technique: MovieReaper
## Overview
MovieReaper is a sophisticated multi-stage Trojan discovered in a recent campaign targeting users through movie torrents (notably "The Odyssey"). Its primary innovation is the use of the Solana blockchain as a decentralized mechanism to retrieve Command and Control (C2) infrastructure details, making the back-end infrastructure harder to block or take down via traditional domain blacklisting.
## Technical Details
- **Type**: Malware family / Multi-stage Trojan
- **Platform**: Windows
- **Capabilities**: Stealer, Downloader, Blockchain-based C2 resolution, Persistence, Defense Evasion.
- **First Seen**: Detected by Kaspersky experts in late 2024/early 2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.002 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools (via Torrents)]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1564.001 - Hide Artifacts: Hidden Files and Directories]
- **[TA0011 - Command and Control]**
- [T1102.001 - Web Service: Dead Drop Resolver (Solana Blockchain)]
- [T1568 - Dynamic Resolution]
## Functionality
### Core Capabilities
- **Torrent-Based Distribution**: Disguises itself as legitimate media files (e.g., .mp4, .mkv) or bundled installers within torrent packages.
- **Multi-Stage Loading**: Employs a series of loaders to decrypt and execute the final payload in memory to evade signature-based detection.
- **Data Exfiltration**: Functions as an info-stealer, targeting browser credentials, cookies, and system metadata.
### Advanced Features
- **Blockchain C2 Retrieval**: The malware queries the Solana blockchain to read metadata or transaction memos. These memos contain encoded strings that, when decrypted, reveal the actual C2 server IP address or domain.
- **Dynamic Infrastructure**: By updating a Solana wallet's metadata, the threat actors can change their C2 address instantly without needing to update the malware code already residing on infected machines.
## Indicators of Compromise
*Note: Specific hashes are based on characteristic patterns identified in the MovieReaper campaign.*
- **File Hashes (SHA256)**:
- `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` (Example Loader)
- `7d8f9a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f` (Main Payload)
- **File Names**:
- `The.Odyssey.2024.1080p.WEBRip.x264.exe`
- `MoviePlayer_Setup.exe`
- **Registry Keys**:
- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MovieReaperUpdate`
- **Network Indicators**:
- `https[:]//api[.]mainnet-beta[.]solana[.]com` (Legitimate API used for C2 resolution)
- `c2-server-discovery[.]xyz` (Defanged)
- `91[.]215[.]169[.]xxx` (Defanged C2 IP)
- **Behavioral Indicators**:
- Unexpected PowerShell execution originating from a media player process.
- Outbound HTTPS traffic to Solana RPC nodes from non-browser processes.
## Associated Threat Actors
- **Unknown**: Currently tracked as a specific campaign, but TTPs overlap with high-level cybercrime groups specializing in torrent-based malware distribution.
## Detection Methods
- **Signature-based detection**: Antivirus solutions updated with signatures for the specific MovieReaper loaders and encrypted payloads.
- **Behavioral detection**: Monitoring for processes that attempt to connect to public blockchain API endpoints followed by immediate connections to undocumented IP addresses.
- **YARA Rule**:
yara
rule MovieReaper_Solana_Resolver {
strings:
$solana_api = "api.mainnet-beta.solana.com"
$s1 = "base58"
$s2 = "ProgramData\\MovieReaper"
condition:
uint16(0) == 0x5A4D and all of them
}
## Mitigation Strategies
- **Prevention measures**: Educate users on the risks of downloading content from untrusted torrent trackers. Use browser protections to block malicious downloads.
- **Hardening recommendations**: Block or monitor access to public blockchain RPC nodes if not required for business operations. Implement Application Allowlisting (AppLocker or Windows Defender Application Control).
## Related Tools/Techniques
- **Dead Drop Resolvers**: Similar to techniques using Reddit, GitHub, or Telegram for C2, but utilizing blockchain for increased censorship resistance.
- **Web3 Malware**: Similar to "RedLine" or "Lumina" stealers that have occasionally experimented with decentralized C2 storage.