- Table of contents
The author
Table of contents
Related Articles
MovieReaper Malware: From Movie Download to Malware Infection
Introduction to MovieReaper Malware
MovieReaper is a malware family first observed in September 2026 that combines remote-access trojan and loader functionality in a modular, multi-stage framework. It targets x86-64 systems and is built to reach remote machines, install additional components, persist across reboots, and exfiltrate data while resisting analysis through anti-sandbox, anti-VM, and AV-evasion features. Its operational significance comes from pairing mass distribution through torrent infrastructure with resilient command-and-control design and reusable in-memory staging.
Delivery Methods of MovieReaper Malware
MovieReaper is distributed through compromised torrent-file infrastructure, with threat actors abusing itorrents[.]org so that users requesting magnet-linked content receive malicious torrent files instead of legitimate ones. Those torrents download a loader disguised as popular movie files, often using long filenames and familiar application icons to obscure the executable extension and increase the chance of manual execution. This approach lets the operators reach users across multiple torrent trackers without compromising each tracker individually.
MovieReaper Malware TTPs and Technical Behavior
After execution, the loader establishes a global mutex, performs anti-sandbox checks, avoids standard API resolution by traversing the PEB and manually parsing loaded DLLs, and downloads shellcode for in-memory execution from a primary domain with an IP fallback. The second stage retrieves the next command-and-control endpoint from a Solana blockchain account, then communicates over HTTPS with certificate pinning and uses protobuf-formatted data to receive and load additional COFF modules directly in memory. A later module performs UAC bypass, persists by masquerading as C:\ProgramData\Microsoft\Windows\Telemetry\msedge.exe, restarts the malware, and signals its execution state so the server can deliver the appropriate next stage. The final recovered implant functions as a file manager that gives operators broad filesystem control, including upload, download, read, directory listing, file manipulation, and preview-based data collection before extraction.
Impact of MovieReaper Malware
A successful infection gives operators durable remote access and a modular platform for sustained post-compromise activity on both individual and organizational systems. Its file-management and exfiltration capabilities create direct risk of data theft, while privilege escalation, persistence, and evasion increase the likelihood that the intrusion remains active and difficult to disrupt. The campaign’s reach across government, technology, retail, business services, and transportation expands the potential for broad operational and security impact.
Threat Actors, Campaigns, and Market Presence of MovieReaper Malware
MovieReaper has been tracked in a large-scale crimeware campaign that began by at least October 2025 and expanded into mass infections identified in mid-August 2026. The activity affected both individuals and organizations across multiple countries and sectors, showing an operator focused on broad opportunistic reach rather than a narrowly scoped victim set.
MovieReaper Malware Ecosystem and Lineage
MovieReaper operates as a self-contained multi-stage framework, with a loader initiating the chain, shellcode fetching decentralized command-and-control information, and later modules extending capability through in-memory execution. Its use of a public torrent-file repository for distribution and the Solana blockchain as a layer for second-stage endpoint discovery places it in a broader ecosystem built for modularity, infrastructure resilience, and reuse in future campaigns.
About Check Point Exposure Management
Check Point Exposure Management is an intelligence-led, validation-driven, remediation-first unified platform that helps security teams move quickly and safely from exposure visibility to exposure reduction. Delivered through a single UI, it brings together threat intelligence, exposure prioritization, Agentic Exposure Validation, and safe remediation so teams can understand risk, prove exploitability, and act from one place.
MovieReaper Malware TTPs
| Tactic Name | Technique |
|---|---|
| Command and Control | T1102.002 – Bidirectional Communication |
| Persistence | T1543.003 – Windows Service |
| Privilege Escalation | T1543.003 – Windows Service |
| Initial Access | T1566.002 – Spearphishing Link |
| Defense Evasion | T1036 – Masquerading |
| Command and Control | T1071 – Application Layer Protocol |
| Impact | T1565.001 – Stored Data Manipulation |
| Command and Control | T1102 – Web Service |
| Defense Evasion | T1070.004 – File Deletion |
| Defense Evasion | T1497 – Virtualization/Sandbox Evasion |
| Discovery | T1497 – Virtualization/Sandbox Evasion |
| Command and Control | T1573 – Encrypted Channel |
| Resource Development | T1588.002 – Software Tools |
| Defense Evasion | T1562.001 – Disable or Modify Tools |
| Exfiltration | T1041 – Exfiltration Over C2 Channel |
| Persistence | T1547.001 – Registry Run Keys / Startup Folder |
| Privilege Escalation | T1547.001 – Registry Run Keys / Startup Folder |
| Discovery | T1082 – System Information Discovery |
| Discovery | T1083 – File and Directory Discovery |
| Collection | T1005 – Data from Local System |
| Execution | T1106 – Native API |
| Command and Control | T1105 – Ingress Tool Transfer |
| Command and Control | T1573.002 – Asymmetric Cryptography |
| Privilege Escalation | T1548.002 – Bypass User Account Control |
| Defense Evasion | T1548.002 – Bypass User Account Control |
| Persistence | T1547 – Boot or Logon Autostart Execution |
| Privilege Escalation | T1547 – Boot or Logon Autostart Execution |
| Defense Evasion | T1036.005 – Match Legitimate Name or Location |
| Defense Evasion | T1497.001 – System Checks |
| Discovery | T1497.001 – System Checks |
| Defense Evasion | T1620 – Reflective Code Loading |
| Privilege Escalation | T1055.012 – Process Hollowing |
| Defense Evasion | T1055.012 – Process Hollowing |
| Privilege Escalation | T1055 – Process Injection |
| Defense Evasion | T1055 – Process Injection |
| Command and Control | T1071.001 – Web Protocols |
| Initial Access | T1195.002 – Compromise Software Supply Chain |
| Execution | T1204.002 – Malicious File |
| Defense Evasion | T1027 – Obfuscated Files or Information |
MovieReaper Malware IOCs
| Type | Date Added | Value |
|---|---|---|
| IPv4 Address | 2026-09-18 | 208.94.246.53 |
| IPv4 Address | 2026-09-18 | 208.64.33.90 |
| IPv4 Address | 2026-09-18 | 193.23.118.155 |
| URL | 2026-09-18 | http://193.23.118.155 |
| URL | 2026-09-18 | https://deadhub.org |
| Domain | 2026-09-18 | deadhub.org |
| MD5 | 2026-09-18 | d88d550d0fb8e60cffff3ea61ff7a067 |
| MD5 | 2026-09-18 | d0b967571ac8a3863c7f324bf5bde99c |
| MD5 | 2026-09-18 | ad4643eea15ac286fa47d1131f9ef756 |
| MD5 | 2026-09-18 | 70060341caf3338697a7ddfe0fb62875 |
| MD5 | 2026-09-18 | a0b13781edd7cfdab13d79afff3c83c1 |
| MD5 | 2026-09-18 | 5310cabae3fbe6db8742849b588093f9 |
| MD5 | 2026-09-18 | 4843f9fafcae492f11e2d4d33dbb4cdd |
| MD5 | 2026-09-18 | 4334bbaea8de33bf9d845e9b4e4e3bc2 |