MovieReaper Torrent-Delivered Modular Malware with Solana-Ba...

[carlospolop]

Blog URL

https://securelist.com/moviereaper-malware-torrent-odyssey-solana/121344

Blog Title

MovieReaper: Torrent-Delivered Modular Malware with Solana-Based C2

Blog high summary

MovieReaper is a Windows modular malware framework delivered through a poisoned torrent repository. Its loader uses encrypted strings, PEB-based API resolution, RWX shellcode, raw syscalls, and EtwpCreateEtwThread. A shellcode stage resolves C2 through Solana, then loads COFF modules in memory. An unspecified public UAC bypass establishes persistence, while the final 21-command file manager enables remote

file operations. No CVE or copy-paste PoC is provided.

PR changes

• src/reversing/common-api-used-in-malware.md: Added or revised coverage of Importless API resolution through PEB.Ldr; VEH-gated syscall and alternative thread startup; Reflective COFF modules; Blockchain account as a C2 dead-drop resolver.

Errors

mdbook build unavailable

[carlospolop]

merge

[carlospolop]

Conflict repair: resolved
Head: d24f9f0a7ee99f86fed6c1dab5099b644be9c4ac

Integrated MovieReaper malware-analysis documentation with current default-branch additions and repaired the reported rendered link.

• Preserved all substantive text and complete fenced examples from both conflict sides.
• Reconciled citations into a sequential reference list while retaining all attribution.
• Verified local destinations and heading anchors, removed the broken README-rendered URL, and confirmed no conflict markers or unmerged entries remain.