Ousaban, also tracked as Javali, is one of the four Brazilian banking trojan families (the 'Tetrade': Grandoreiro, Guildma, Melcoz, Ousaban/Javali) documented by Kaspersky since 2020 as having expanded operations beyond Brazil into Latin America and Europe. Active since 2017, Javali historically targeted Mexican banking customers; the campaign analyzed here by FortiGuard Labs (May 2026) represents a resurfaced, Iberian-focused wrapper of the same core malware targeting Spanish and Portuguese bank customers.

The infection chain begins with a phishing email or lure delivering a PDF disguised as a corrupted document. The PDF displays a fake rendering error and an 'Atualizar' (Update) button; clicking it triggers hidden JavaScript that redirects the victim to a malicious webpage impersonating a government tax portal (invoice/'factura' themed). This landing page performs environment profiling and geofencing entirely server-side (an evolution from an earlier, late-2025 variant that performed these checks client-side in JavaScript, making them trivially visible to analysts). The server-side check inspects the visitor's Accept-Language header, timezone, and IP geolocation to restrict the attack to visitors appearing to be in Spain or Portugal; it blocks connections whose IP WHOIS/organization metadata contains the string 'vpn'; and it profiles screen resolution, browser rendering behavior, and installed font enumeration to detect and exclude sandboxes, headless browsers, and automated crawlers used by security researchers.

Visitors who pass all checks are served a VBS (VBScript) downloader. The VBS script fetches an image file styled to resemble a PDF icon; the image uses steganography to conceal an appended ZIP archive containing the Ousaban payload. The script extracts the ZIP, drops the executable into a Temp-folder working directory (observed path pattern C:\SysMain_<random-digits>), executes it, and deletes the staging artifacts to complicate forensic recovery. An empty marker file named maisum.dat is created whose file-creation timestamp is used by the malware as an installation-time reference.

Ousaban establishes persistence by writing a value named 'Financeiro' (Portuguese for 'Financial') to the HKCU\...\CurrentVersion\Run registry key, causing the payload to auto-launch at every Windows logon. Once resident, the trojan remains dormant, monitoring the foreground window/process list until the victim navigates to one of dozens of targeted banking or fintech domains (Santander, BBVA, CaixaBank, Bankinter, Caixa Geral de Depósitos, Revolut, and 19+ others encrypted within the binary). On trigger, Ousaban activates its banking-fraud module: it displays fake overlay/message screens to distract or instruct the victim while performing background fraud, captures full-screen screenshots and streams them to the operator for real-time remote-control ('hands on keyboard') account takeover, logs keystrokes, and hijacks clipboard contents (a classic technique for silently swapping copied bank-account/IBAN numbers with attacker-controlled ones — 'clipper' behavior).

Ousaban's C2 channel is designed to resist static IOC blocking and sinkholing. A decoy Pastebin link is present in the sample and points to a non-routable/dead IP, intended to mislead analysts who pivot on it. The real C2 address is a daily-rotating subdomain computed as 'aki' + the first 8 hex characters of an MD5 hash of a hardcoded secret string concatenated with the current date. To obtain a reliable, tamper-resistant timestamp independent of the victim's local clock, the malware issues a request to Google's 'automated queries' rate-limit/CAPTCHA error page and parses the server-returned date from the HTTP response — an unusual living-off-trusted-services technique for time synchronization that also blends the request into background Google traffic.

Command-and-control communication uses a small tagged-command protocol observed in the sample: #Convite# (collects and exfiltrates victim/system information), #Handle# (assigns a unique victim/session ID), #ON-LINE# (heartbeat/keepalive), #xyScree# (queries victim screen resolution to size overlay windows), and #Iniciar# (initiates screenshot capture and remote-control session). Exfiltrated data and C2 traffic are protected with a custom XOR-based stream cipher: a random initial byte is chosen as a base offset, and each subsequent plaintext byte is XORed against a rotating key byte; when the raw XOR result is numerically smaller than the current base offset, 0xFF is added to the difference before use. Because the initial byte is randomized per session, identical plaintext produces different ciphertext across sessions, defeating naive pattern-based network signatures. Researchers (Li Zhao, Black Duck) note this exact cipher construction is also used by the related Latin American banking trojan Casbaneiro and dates to code shared since at least 2008, indicating Ousaban is an incrementally hardened evolution of long-standing Tetrade tradecraft rather than a technically novel banking trojan.

An earlier, related wave of activity in late 2025 delivered the same malware family via a ClickFix social-engineering lure (fake CAPTCHA/verification prompting victims to paste and run a PowerShell/mshta command) combined with an MSI-based installer, indicating the threat actor iterates delivery mechanisms while reusing the core Ousaban payload and C2 design.