Ousaban Banking Trojan Targets Iberian Peninsula via Steganographic Delivery Chain

Key facts for Ousaban steganographic phishing

Detection coverage for Ousaban steganographic phishing

As of 2026-09-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2305 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Ousaban Persistence via Financeiro Registry Run Key and SysMain_5874288 Payload Drop

Detects the post-exploitation footprint of an active Ousaban infection: creation of the "Financeiro" value under the Registry Run key, file drops to the hardcoded C:\SysMain_5874288 staging directory or the maisum.dat execution-timestamp tracker, matching payload/MSI SHA256 hashes, and msiexec.exe invoked as a system-binary-proxy from a scripting host — any one of these confirms the trojan has installed and is preparing to run.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1547.001, T1027.003, T1140, T1070.004, T1036.005, T1218.007
• Data sources: sysmon (Event ID 1/11/13), Microsoft Defender for Endpoint DeviceRegistryEvents/DeviceFileEvents/DeviceProcessEvents
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon
  (EventCode=13 TargetObject="*\\CurrentVersion\\Run\\Financeiro")
  OR (EventCode=11 (TargetFilename="C:\\SysMain_5874288\\*" OR TargetFilename="*\\maisum.dat"))
  OR (EventCode=11 Hashes IN ("*21b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd*","*d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3*","*ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c*","*18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e*","*4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb*","*5837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d*","*e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14*"))
  OR (EventCode=1 Image="*\\msiexec.exe" ParentImage IN ("*\\wscript.exe","*\\cscript.exe"))
| eval detection_reason=case(
    EventCode=13, "registry_run_key_financeiro",
    EventCode=11 AND like(TargetFilename,"%SysMain_5874288%"), "payload_drop_sysmain",
    EventCode=11 AND like(TargetFilename,"%maisum.dat%"), "timestamp_tracking_file",
    EventCode=11, "known_payload_msi_hash_match",
    EventCode=1, "msiexec_proxy_execution_from_script")
| stats count values(detection_reason) as reasons values(TargetObject) as registry_keys values(TargetFilename) as files values(CommandLine) as commands earliest(_time) as first_seen latest(_time) as last_seen by Computer, User
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")

Microsoft KQL

let PayloadHashes = dynamic(["21b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd","d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3","ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c","18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e","4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb","5837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d","e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14"]);
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and RegistryValueName == "Financeiro"
| project Timestamp, DeviceName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has "SysMain_5874288" or FileName =~ "maisum.dat" or SHA256 in~ (PayloadHashes)
    | project Timestamp, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256
)
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "msiexec.exe" and InitiatingProcessFileName in~ ("wscript.exe","cscript.exe")
    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
)

Sigma

title: Ousaban Post-Exploitation Registry Persistence and Payload Drop
id: b2e4d9ef-7c3b-4fae-ad42-8064c9f5b211
status: experimental
description: Detects the Ousaban banking Trojan's persistence and installation footprint via its distinctive "Financeiro" Registry Run value, the C:\SysMain_5874288 staging path, the maisum.dat timestamp tracker, or matching payload/MSI SHA256 hashes.
references:
    - https://www.fortinet.com/blog/threat-research/analysis-of-ongoing-ousaban-attacks-targeting-the-iberian-peninsula
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-03
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1218.007
    - attack.tool.ousaban
logsource:
    category: registry_set
    product: windows
detection:
    selection_registry:
        TargetObject|endswith: '\CurrentVersion\Run\Financeiro'
    selection_path:
        TargetFilename|contains:
            - 'C:\SysMain_5874288\'
            - '\maisum.dat'
    selection_hash:
        Hashes|contains:
            - '21B24F7EE1F6BDBBB670F0394D66009EE0DAA8CED57048298DA715E88F7A7CDD'
            - 'D4EB4FF02DF659FDEEC17D36B77084627469623BB3C7D16383D257404B52D1C3'
            - 'FFB9EB47CC0CB2F43E04A10DC84DF13D04BCA1EBACBE47FAD0B669728DE2F59C'
    condition: 1 of selection_*
falsepositives:
    - None expected for the exact "Financeiro" value name or the SysMain_5874288 path, which are campaign-specific artifacts and not standard Windows/Sysmain naming
level: critical

Known false positives:

• Legitimate financial/accounting software occasionally using generic Portuguese-language value names — verify against the exact literal "Financeiro" plus the co-occurring SysMain_5874288/maisum.dat artifacts before escalating

Tuning notes: TL_OSINT_Scan community corroboration (single sighting, reporter malwrhunterteam) tags payload hash d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3 with the external label "RustyStealer" rather than Ousaban — treat this as low-confidence OSINT corroboration, not a reclassification; investigate any hit on that specific hash for secondary/unrelated tooling before triaging it purely as Ousaban. This is behavioral/artifact-based rather than signature-based, so it survives binary repacking as long as the registry value name and staging path stay constant across campaign waves.

• 🔒 Ousaban Geofenced Landing Page Visit After PDF Lure Click-Through · unlock with TL Creds
• 🔒 Ousaban Msiexec Proxy Execution and Local Data-Staging Behavior · unlock with TL Creds
• 🔒 Ousaban DNS/Network Beacon to "aki"-Prefixed DuckDNS Domain Generation Pattern · unlock with TL Creds
• 🔒 Ousaban VBS Downloader Extracting Steganographic Payload · unlock with TL Creds
• 🔒 Ousaban "Financeiro" Registry Run Key Creation · unlock with TL Creds
• 🔒 Ousaban Pastebin Dead-Drop Resolver Access from Scripting/Payload Process · unlock with TL Creds
• 🔒 Ousaban Phishing PDF Lure with Hex-Escaped JavaScript and "Atualizar" Update Button · unlock with TL Creds
• 🔒 Ousaban Daily-Rotating DDNS C2 Beaconing and Pastebin Dead-Drop Configuration Retrieval · unlock with TL Creds

Indicators of compromise for Ousaban steganographic phishing

As of 2026-09-03, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-2305.

Sample indicators (3 of 29)

• IP address: 213.159.64[.]191
• Domain: faturanova[.]xyz
• File hash: 6bc2e11b0917f47d0557288c4f0cb20bd7589185943b989a969fdc6d3704ee73

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

Community OSINT corroboration for Ousaban steganographic phishing

3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Ousaban steganographic phishing works

Ousaban shares a custom XOR-plus-offset encryption algorithm with the related Casbaneiro Trojan and provides keylogging, clipboard hijacking, screenshot capture, and remote control over daily-rotating DDNS C2 infrastructure.

Ousaban (also tracked as Javali) is a Delphi-based Brazilian banking Trojan belonging to the "Tetrade" cluster of related LATAM banking malware families identified by Kaspersky, alongside Grandoreiro, Guildma/Astaroth, and Melcoz. Historically focused on Brazilian financial institutions, FortiGuard Labs identified an expansion of the family's operators into Spain and Portugal in May 2026, publishing a detailed writeup on July 1, 2026.

The attack begins with a phishing PDF disguised as a corrupted file that displays a deceptive "Atualizar" (Update) button and contains hex-escaped JavaScript. Clicking the button routes the victim to a geofenced landing page masquerading as a tax document or installer source; the page performs server-side environmental checks (IP address, browser language, timezone, screen resolution, rendering behavior, and font enumeration) and blocks requests containing VPN-related keywords, serving either an error or the next-stage download depending on the check outcome.

Successful checks deliver a VBS downloader that mixes benign function calls with malicious logic, extracts a steganographic image disguised as a PDF icon, decodes an embedded ZIP archive from the image, and drops the Ousaban payload to C:\SysMain_5874288 before self-deleting. Ousaban establishes persistence via a "Financeiro" value under the Registry Run key, tracks execution timestamps in a maisum.dat file, and decrypts a hardcoded list of 13+ targeted Spanish and Portuguese banks (including Banco Santander, BBVA, CaixaBank, Bankinter, and Caixa Geral de Depósitos) using the same custom XOR-plus-offset algorithm documented in the Casbaneiro Trojan. Once active, it provides keylogging, clipboard injection, screenshot capture, fake on-screen message generation, and full remote mouse/keyboard control to the operator.

Command and control uses DDNS subdomains that rotate daily, computed as a hardcoded "aki" prefix concatenated with the first eight characters of an MD5 hash derived from a fixed secret string and the current date; the malware fetches the current date via an intentional request to a Google Automated Queries page. Configuration and decoy data are staged on Pastebin, consistent with the broader Ousaban family's documented history of abusing legitimate cloud services (Amazon S3, Google Docs, Google Cloud Run) for payload hosting and C2 configuration retrieval in earlier LATAM-focused campaigns dating back to at least 2021.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1218.007 Msiexec; T1497.001 System Checks

Credential Access

T1056.001 Keylogging

Execution

T1059.005 Visual Basic; T1204.001 Malicious Link; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1568.002 Domain Generation Algorithms

Collection

T1113 Screen Capture

Persistence

T1547.001 Registry Run Keys / Startup Folder

Initial Access

T1566.001 Spearphishing Attachment

Remediation for Ousaban steganographic phishing

Immediate actions

• Block the identified Ousaban C2/delivery domains and IPs (faturanova.xyz, facture-in.pages.dev, facture-arsys.duckdns.org, faturanova.duckdns.org, controlfacturas.site, 213.159.64.191, 162.33.179.46, 91.92.240.140, 78.40.209.32) at DNS and network perimeter
• Hunt endpoints for the Registry value HKCU\...\CurrentVersion\Run\Financeiro and the file path C:\SysMain_5874288
• Quarantine/block the identified PDF, HTML, VBS, MSI, and EXE hashes at the EDR/AV layer
• Alert on inbound PDFs containing hex-escaped JavaScript or deceptive "Atualizar"/update-themed action buttons

Workarounds

• Disable or restrict Windows Script Host (WSH) on endpoints that do not require VBS/JS scripting
• Block outbound access to Pastebin and similar paste/dead-drop services from endpoints where not business-required

Longer-term hardening

• Deploy EDR with behavioral detection for wscript.exe/cscript.exe execution chains that extract and decode image files
• Enforce application control restricting Windows Script Host execution from user-writable and Downloads directories
• Implement DNS monitoring/filtering for dynamic DNS providers (e.g. duckdns.org) and newly-registered lookalike domains used for daily C2 rotation
• Deliver user awareness training on Portuguese/Spanish-language phishing lures impersonating tax notices, invoices, and software update prompts

Affected and fixed versions

• Microsoft — Windows desktop systems with Windows Script Host enabled
  Vulnerable versions: Windows 10; Windows 11
• Banco Santander — Online banking customers (Spain)
• BBVA — Online banking customers (Spain)
• CaixaBank — Online banking customers (Spain)
• Bankinter — Online banking customers (Spain)
• Caixa Geral de Depósitos — Online banking customers (Portugal)

Timeline of Ousaban steganographic phishing

• 2021-05-05 ESET Research publishes the first major public analysis of the Ousaban banking Trojan family, documenting its history of hiding payloads inside media files, protecting executables with Themida/Enigma packers, and using binary padding for evasion.
• 2022-08-04 Netskope documents Ousaban abusing Amazon S3 and Google Docs to host second-stage payloads and retrieve C2 configuration in Brazil-focused campaigns.
• 2024-02-20 Cisco Talos reports Ousaban, alongside Astaroth/Guildma and Mekotio, abusing Google Cloud Run for high-volume malware distribution across Latin America and Europe, with activity observed since September 2023.
• 2026-05-01 Ousaban begins beaconing to daily-rotating DDNS subdomains (prefix "aki" plus an 8-character MD5 hash derived from a hardcoded string and the current date) and retrieves configuration data staged on Pastebin.
• 2026-05-01 Ousaban establishes persistence via a "Financeiro" Registry Run key value and begins timestamp tracking through a maisum.dat file.
• 2026-05-01 The landing page serves a VBS downloader that extracts a steganographic image resembling a PDF icon, decodes an embedded ZIP archive, and drops the Ousaban payload to C:\SysMain_5874288.
• 2026-05-01 Victims clicking the PDF's link are routed to a geofenced landing page that performs server-side IP, language, timezone, screen-resolution, and font-enumeration checks and blocks requests containing VPN-related keywords.
• 2026-05-01 Campaign delivery begins with phishing PDFs disguised as corrupted documents, featuring a deceptive "Atualizar" (Update) button and hex-escaped embedded JavaScript.
• 2026-05-01 FortiGuard Labs first identifies the Ousaban campaign targeting Windows users banking in Spain and Portugal (month-level precision per source, exact day not disclosed).
• 2026-07-01 FortiGuard Labs publishes a detailed public analysis of the ongoing Iberian Ousaban campaign, releasing IOCs covering 5 domains, 4 IPs, and 20 file hashes.

Sources cited for Ousaban steganographic phishing

• Ousaban: LATAM Banking Malware Abusing Cloud Services netskope.com · Vendor report · 2022-08-04
• Astaroth, Mekotio & Ousaban abusing Google Cloud Run in LATAM-focused malware campaigns Cisco Talos · Vendor report · 2024-02-20
• Ousaban: Private photo collection hidden in a CABinet ESET WeLiveSecurity · Research · 2021-05-05
• Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula Fortinet · Blog · 2026-07-01
• Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures The Hacker News · News · 2026-07-01

Threats related to Ousaban steganographic phishing

• Ousaban Banking Trojan (Tetrade/Javali) Targets Iberian Banks via Phishing PDFs, Fake Tax Portal, and Steganographic VBS Downloader
• Ousaban (Javali) Banking Trojan Expands Grandoreiro-Linked Tetrade Campaign to Target Iberian Banking Users in Spain and Portugal
• Ousaban Banking Trojan Campaign Targeting Banking Users in Spain and Portugal
• Grandoreiro Banking Trojan Multi-Vector Campaign: ClickFix Delivery via canalmodup.com, Dual DLL Sideloading (GoToMeeting/Nero), PIX QR Interception in Brazil, and Parallel WebRTC/STUN Campaign Targeting Iberian Banks
• Operation Turb00: Multi-Stage HijackLoader (IDAT Loader) Campaign Delivers Vidar v2.1 Infostealer and SnappyClient RAT via PNG-IDAT Steganography

Related coverage of this activity

• Astaroth WhatsApp spambot module
• JanelaRAT banking trojan
• arrayref DPRK backdoor