For my Brazilian ThreaHunting/DFIR friends: Been reversing a malware called “#CNABHunter” (NUikita), and this thing is way more interesting than a regular banking trojan. At first I had to figure out what “CNAB240/400” even was — apparently it’s a financial file standard heavily used by Brazilian ERP/banking integrations. The malware hunts for those files in environments running TOTVS, SAP, RM, Senior, Sankhya, etc., extracts transaction data, and waits for remote commands to modify payments. Most interesting part: it doesn’t do dumb string replacement. The malware appears to rebuild the entire financial record using the correct field positions to keep the file structurally valid for banking processing. Maybe my interpretation of this behavior is wrong, but that’s what I’ve understood so far from reversing it. C2: 104.245.245[.]50:5000