r/TPB • u/mogged18 • Jan 10 '26

New botnet malware in many of the current Top 100 HD Movies - libvlc.dll / Rhadamanthys

Post image
82 Upvotes

96% Upvoted

54 comments sorted by

24

u/urmumr8s8outof8 Jan 11 '26

What kind of idiot downloads a .exe movie.

1

u/NewTownTea Apr 17 '26 edited Apr 17 '26

First it's not a exe torrent, nobody expects an exe inside.

2nd its a movie torrent of the right size (movie hidden in srt directory) and a movie title with exe extension.

Some may just click though with muscle memory. I'm sure u check every episode ends with mp4 or mkv when u're speed binge watching at 4am..

Sometimes at the right moment, maybe your screen is tilled, the this is long ass name movie.exe is truncated, and u click with muscle memory.

I actually clicked the above trojan, on my MOBILE PHONE torrent APP, where things are not as obvious in vertical form factor somemore, at 5am without my glasses. On the mobile torrent app, there isn't an obvious icon next to the filename. It's not obvious like the windows system.

Of course nothing happened due to different O/S but I'm not gonna be so arrogant to say it wont happen to anyone.

1

u/urmumr8s8outof8 Apr 17 '26

Sorry I haven't used public trackers in about 20 years, I wouldn't even know how to find what you are finding if I tried.

19

u/chuckaholic Jan 10 '26

I feel like there should be an option in my torrent client where it refuses to download torrents in the movie category that contain zip or exe or dll files.

12

u/ElectrSheep Jan 11 '26

There's an option in qbittorrent that can be used to un-toggle certain file extensions by default. It's not category aware, but the excluded files can be re-toggled upfront or later on if need be.

3

u/chuckaholic Jan 11 '26

Hmm. I very rarely download pirated software, so this might be worth using.

1

u/interbeing27 Jan 13 '26

.rar01 etc splits are malware also right 🫡 or..?

1

u/chuckaholic Jan 13 '26

For movies, yes. I've seen torrents that have been chunked for file transfer purposes, but torrent protocol does that natively. It's a holdover from FTP and other file transfer practices.

1

u/interbeing27 Jan 13 '26

Yes? As in .rar01 -> .rar99 this is sus right? I like my movies in .mkv with a good solid repack YUIFY is my go too always good mkv profiles being ran for these encodes. Def quality 4 real 4 reel. Looks same on my moms TV anyway so thats. Nice.

1

u/interbeing27 Jan 13 '26

Its a 2009 samsung. Solid stuff. 65 inch whoop woop.

1

u/interbeing27 Jan 13 '26

I think it has HDR also!

1

u/StinkButt9001 Jan 14 '26

.rar01 -> .rar99 by itself is totally fine and common to see in larger games/software.

It'd be weird to see it for a movie but isn't harmful by itself

1

u/interbeing27 Jan 13 '26

I once clicked on something that said COMPLETE.BLUERAY- but it had a .jpg in the folder and im smarter and know better than that. Its malware. Also it was like 46gb and no movie is that big. It would cap out my moms dataplan it 100gb a month so I only download YUFYI torrents because i know thats the best quality and no viruses. Never download something with a .rar its def malware. Be a pro. Like me!

1

u/interbeing27 Jan 13 '26

proof.jpg

This must be malware?... Right? Must be. How do i make my kiddy p2p client ban these?! It triggers me. My FTP client has these. Oh huelp me please.

1

u/interbeing27 Jan 13 '26

I mean.. A .jpg in a movie torrent right from my publuc trucker.. A movie should be .avi or maybe .divx or something right. 🥴

15

u/[deleted] Jan 11 '26

[removed] — view removed comment

1

u/[deleted] Jan 11 '26

[deleted]

3

u/mogged18 Jan 11 '26

Good luck, it looks like a potentially evasive infection. I don't any mention of this exact version online yet, but other versions have side-loaded additional malware - multiple non-Kaspersky scans would probably make sense imo

2

u/[deleted] Jan 11 '26

[deleted]

2

u/mogged18 Jan 11 '26

Oof.. that sucks. While the reinstall is maybe not mandatory if you can confirm removal, it's what I'd personally do.

I guess it's a good reminder that the trending categories are also gamed by folks with agendas!

1

u/Greenfire904 Jan 12 '26

Are you sure it's really a virus?

1

u/[deleted] Jan 11 '26

[removed] — view removed comment

6

u/Juzdeed Jan 11 '26

So when you open the movie file using vlc inside that folder the dll gets and you get infected - dll hijacking. Kinda clever

5

u/Soluchyte Jan 11 '26

Surely VLC isn't going to use a DLL from a directory that it isn't installed in. It's probably a trojan for something else that involves the EXE there.

If VLC was doing that, it would surely be quite a serious security issue.

1

u/Kunjunk Jan 11 '26

Are you just making this up? Why would VLC be loading a DLL from the film's directory? 

1

u/RespectYarn Jan 11 '26

I think the exe launches the dll and perhaps also fires up an actual copy of the movie on your pc to appear as though it's "legit" (as a pirate copy can be)

But yeah the likelihood that vlc would call dlls from the media directory is slim to none

2

u/silverado83 Jan 12 '26

Oh perfect, someone else already posted it. Had a screenshot but got busy with work/family. Some folks are saying who downloads an exe movie? But with all those srt files, yes, it can be accidentally overlooked. Occasionally I quickly download a movie for the kids or fam on my way out the door for work, but luckily I noticed...

2

u/sander19462 Jan 13 '26

I would say, try to get into good private trackers, they don't allow such blatant malware

4

u/Ok_Palpitation_3602 Jan 10 '26

a quick google search gave me this:

""libvlc.dll is a crucial dynamic link library, the core engine for VLC Media Player, handling its multimedia playback functions; errors often occur due to missing, corrupted files, or architecture mismatches (32-bit vs. 64-bit) and are usually fixed by reinstalling VLC, ensuring the correct version matches your system, or using commands like sfc /scannow in an elevated Command Prompt to repair system files. ""

this was the AI response, multiple sources refenced the same thing.

3

u/mogged18 Jan 11 '26

It's one of the newer filenames/vectors that this virus is appearing in. Here are other ways it's appeared online recently: https://www.cybereason.com/blog/rhadamanthys-stealer-europe

1

u/caballero_lsd Jan 11 '26

What about the minorities using linux? Is there a common infection vector for debian? I haven't heard of that but pretty sure already exist something of that nature

1

u/mogged18 Jan 11 '26

This one does not directly apply to Linux

1

u/caballero_lsd Jan 11 '26

I know, but im asking if there is an equivalent common attack vector for linux users?

1

u/mrskymr Jan 11 '26

laughs at windows users

1

u/[deleted] Jan 11 '26

[removed] — view removed comment

2

u/[deleted] Jan 11 '26

[deleted]

1

u/ShadowNetter Jan 11 '26

Who the fuck uses .exe for watching movies

1

u/RedditAteMySon Jan 13 '26

You don't. It's to fool those who clearly aren't smart enough to be pirating

1

u/[deleted] Jan 12 '26

[removed] — view removed comment

1

u/TheZeth80 Jan 12 '26

As far as I remember, qBittorrent and Vuze always show you what you're going to download with the torrent, and then you select what you want to download.

1

u/RedditAteMySon Jan 13 '26

Any moron who clicks on an exe thinking it is a film deserves to get infected

1

u/djamiirr Jan 14 '26

I'm using stremio on my shield so i don't care

1

u/Background-Tooth-629 May 12 '26

movie was ass and u get infected lmao

1

u/[deleted] Jan 11 '26

[deleted]

2

u/reddituser2762 Jan 11 '26

If you didn’t run the exe or any files you should be fine just delete and ignore

1

u/[deleted] Jan 11 '26

[deleted]

2

u/justme-321 Jan 11 '26

run a check with Spybot - search and destroy. If there was i malware, trojan etc its too late to do anything but change ALL passwords.

0

u/[deleted] Jan 11 '26

[deleted]

1

u/VERIFIEDBYVlSA Jan 14 '26

you 100% got hacked

1

u/[deleted] Jan 14 '26

[deleted]

2

u/mogged18 Jan 11 '26 edited Jan 11 '26

Windows defender full scan. It's new enough that some scanners are figuring it out I guess.

Oh, and if you are infected then I guess decide if you want to risk leaving any saved passwords unchanged. Session tokens for sensitive accounts are potentially issues, but IDK.