CrashFix Finger LOLBIN Abuse with C2 Communication

Lacey Cochrane@NullVectorX

•updated Feb 10, 2026•9•0•102

Detects the execution of 'finger.exe' or 'ct.exe' with command-line arguments indicating an attempt to start 'cmd.exe', correlated with network connections to a known malicious IP address (69.67.173.30). This behavior is indicative of LOLBIN (Living Off the Land Binaries and Scripts) abuse for command and control communication.