For my Brazilian ThreaHunting/DFIR friends:
Been reversing a malware called “#CNABHunter” (NUikita), and this thing is way more interesting than a regular banking trojan.
At first I had to figure out what “CNAB240/400” even was — apparently it’s a financial file standard heavily used by Brazilian ERP/banking integrations.
The malware hunts for those files in environments running TOTVS, SAP, RM, Senior, Sankhya, etc., extracts transaction data, and waits for remote commands to modify payments.
Most interesting part: it doesn’t do dumb string replacement.
The malware appears to rebuild the entire financial record using the correct field positions to keep the file structurally valid for banking processing.
Maybe my interpretation of this behavior is wrong, but that’s what I’ve understood so far from reversing it.
C2: 104.245.245[.]50:5000
Mr. Titus Tech is correct. cpuid-dot-com is indeed delivering malware right now.
As I began poking this with I stick I discovered this is not your typical run-of-the-mill malware. This malware is deeply trojanized, distributes from a compromised domain (cpuid-dot-com), performs file masquerading, is multi-staged, operates (almost) entirely in-memory, and uses some interesting methods to evade EDRs and/or AVs such as proxying NTDLL functionality from a .NET assembly.
The C2 domain present in one of the binaries is a clear IoC. This is the same Threat Group who was masquerading FileZilla in early March, 2026. They've been busy.
Vitória brasileira: Fruto do esforço científico nacional, a Butantan-DV começou a ser desenvolvida em 2009, quando o Brasil enfrentava recordes de dengue. Foram 270 experimentos e 50 tentativas de formulação até chegar ao produto final. Saiba mais: https://t.co/Jq1CnueM1I
Max Verstappen’s Brazil pitlane start from Ocon’s onboard camera. Ocon was like bro wait for me, but Max disappeared into the distance 😭
This shows exactly why Max’s SC restarts are so good.
EDITORIAL: Alguém tem vergonha na cara – Um promotor de Justiça aposentado recusou penduricalho de R$ 1,3 milhão e ainda foi ao STF para pedir que os atos que criam o benefício sejam declarados nulos, porque são ilegais e imorais 🔗 https://t.co/JaadRr1aFX 📸: Daniel Teixeira/Estadão