GoKawiilMalicious .exe disguised as South Park episode spreads via torrent trackers, evades Sonarr blocklist checks
A user running the *arr media automation stack discovered that Sonarr had automatically grabbed a file posing as a South Park episode, which was actually an .exe with thousands of seeders on public torrent trackers. Analysis showed the file was padded with 886MB of junk data to evade antivirus scanners, with a genuine 118KB payload full of junk code designed to obstruct reverse-engineering in tools like IDA.
GoKawiil's interpretation of the reporting above, not reported fact.
This case illustrates how automated media-fetching tools like Sonarr can be tricked into downloading malware disguised as legitimate TV episode files, since they primarily match on filename patterns rather than verifying file types. The padding and obfuscation techniques described suggest attackers are deliberately targeting antivirus scanners and reverse engineers who have size or complexity thresholds, which could mean such techniques are spreading across torrent-based malware campaigns.
- A fake South Park episode file with 2,392 seeders was actually a disguised executable that automated downloaders may grab unknowingly.
- The file used nearly 900MB of junk padding specifically to bypass antivirus scanners that skip large files.
- The code contained deliberate obfuscation (meaningless XOR operations) intended to frustrate reverse engineering efforts.
Synology DS224+ NAS — If you're running the *arr stack like Sonarr and qBittorrent, having dedicated, reliable NAS hardware makes managing your media automation and download pipeline way smoother. The Synology DS224+ is a solid, purpose-built box for exactly this kind of home server setup, with DSM software that makes Docker/container management for your arr stack straightforward.
See Synology DS224+ NAS on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: thereallo.dev, 2026-10-15
Published there as: “Someone on Torrent Sites Kept Fucking with My Sonarr”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.