finger.exe

finger.exe is a Windows utility for querying user information via the Finger protocol. In January 2026, the KongTuke threat actor introduced "CrashFix" - a variant where a malicious Chrome extension ("NexShield", impersonating uBlock Origin Lite) intentionally crashes the browser, then displays a fake "browser stopped abnormally" error. The fix command copies finger.exe to the temp directory, renames it (e.g., to ct.exe), and uses it to connect to an attacker C2 server. The C2 response is piped directly to cmd.exe for execution. The final payload is ModeloRAT, a Python RAT that specifically targets domain-joined hosts.