Eder Machado

[Johnk3r @johnk3r]

For my Brazilian ThreaHunting/DFIR friends:

Been reversing a malware called “#CNABHunter” (NUikita), and this thing is way more interesting than a regular banking trojan.

At first I had to figure out what “CNAB240/400” even was — apparently it’s a financial file standard heavily used by Brazilian ERP/banking integrations.

The malware hunts for those files in environments running TOTVS, SAP, RM, Senior, Sankhya, etc., extracts transaction data, and waits for remote commands to modify payments.

Most interesting part: it doesn’t do dumb string replacement.

The malware appears to rebuild the entire financial record using the correct field positions to keep the file structurally valid for banking processing.

Maybe my interpretation of this behavior is wrong, but that’s what I’ve understood so far from reversing it.

C2: 104.245.245[.]50:5000

[vx-underground @vxunderground]

Mr. Titus Tech is correct. cpuid-dot-com is indeed delivering malware right now.

As I began poking this with I stick I discovered this is not your typical run-of-the-mill malware. This malware is deeply trojanized, distributes from a compromised domain (cpuid-dot-com), performs file masquerading, is multi-staged, operates (almost) entirely in-memory, and uses some interesting methods to evade EDRs and/or AVs such as proxying NTDLL functionality from a .NET assembly.

The C2 domain present in one of the binaries is a clear IoC. This is the same Threat Group who was masquerading FileZilla in early March, 2026. They've been busy.

[Max Verstappen @VerstappenCOM]

Hello there 😍

[Eder Machado @edermachado]

@MobilidadeSampa interdição total Francisco Matarazzo antes do shopping West Plaza sentido centro.

[Red Bull @redbull]

2026 fit check 😮‍💨

[Oracle Red Bull Racing @redbullracing]

A fresh coat of paint for a brand-new era 🎨

@FordRacing || #RedBullRacing

[Ford Racing @FordRacing]

First sounds of history.

Ford Racing Hypercar coming 2027.

[CONMEBOL Libertadores @LibertadoresBR]

🧤⚽️ Weverton, uma história de #GloriaEterna pelo @Palmeiras.

⭐️ CONMEBOL #Libertadores

[Eder Machado @edermachado]

@TifeRMFC @Oficial_RC3

[Honda Racing F1 @HondaRacingF1]

You heard it here first. Our soundtrack for 2026 🔊​

​#F1

[RBR Daily @RBR_Daily]

Thanks for the memories and the wins!
Farewell Honda 🫡

[Eder Machado @edermachado]

Thank you @HondaRacingGLB

[Eder Machado @edermachado]

Congratulations @HondaRacingF1 @redbullracing #RedBullRacing #HondaF1

[Valtteri Bottas @ValtteriBottas]

Last dance with @MercedesAMGF1

[Instituto Butantan @butantanoficial]

Vitória brasileira: Fruto do esforço científico nacional, a Butantan-DV começou a ser desenvolvida em 2009, quando o Brasil enfrentava recordes de dengue. Foram 270 experimentos e 50 tentativas de formulação até chegar ao produto final. Saiba mais: https://t.co/Jq1CnueM1I

[MV33Racing🏎 @MV33Racing]

Max Verstappen’s Brazil pitlane start from Ocon’s onboard camera.

Ocon was like bro wait for me, but Max disappeared into the distance 😭

This shows exactly why Max’s SC restarts are so good.

[CORSARIO15K @avengerprivate2]

Eu faria esse acordo é vc faria ?

[Eder Machado @edermachado]

@LDU_Oficial Noche Mágica de Copa

[Arquivo Curioso @arquivocurioso]

Terra e Lua passando em frente ao Sol. Filmagem de 14 de janeiro de 2005 a partir da sonda Huygens que estava próximo a Saturno.

[Estadão 🗞️ @Estadao]

EDITORIAL: Alguém tem vergonha na cara – Um promotor de Justiça aposentado recusou penduricalho de R$ 1,3 milhão e ainda foi ao STF para pedir que os atos que criam o benefício sejam declarados nulos, porque são ilegais e imorais 🔗 https://t.co/JaadRr1aFX 📸: Daniel Teixeira/Estadão