# Ousaban Banking Trojan Targets Iberian Peninsula via Steganographic Delivery Chain

> An ongoing campaign, first identified by FortiGuard Labs in May 2026, delivers the Brazilian Ousaban (aka Javali) banking Trojan to Windows users banking in Spain and Portugal through a phishing PDF, a geofenced landing page, a VBS downloader, and a steganographic image concealing a ZIP payload. Ousaban shares a custom XOR-plus-offset encryption algorithm with the related Casbaneiro Trojan and provides keylogging, clipboard hijacking, screenshot capture, and remote control over daily-rotating DDNS C2 infrastructure.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2305
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-ousaban-steganographic-phishing-tl-2026-2305.webp?v=04843667 (Threadlinqs threat intel: Ousaban Steganographic Delivery Trojan: Detection & IOCs (TL-2026-2305) — High severity, 29 IOCs, 9 detection rules.)
- **ID:** TL-2026-2305
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

Ousaban (also tracked as Javali) is a Delphi-based Brazilian banking Trojan belonging to the "Tetrade" cluster of related LATAM banking malware families identified by Kaspersky, alongside Grandoreiro, Guildma/Astaroth, and Melcoz. Historically focused on Brazilian financial institutions, FortiGuard Labs identified an expansion of the family's operators into Spain and Portugal in May 2026, publishing a detailed writeup on July 1, 2026.

The attack begins with a phishing PDF disguised as a corrupted file that displays a deceptive "Atualizar" (Update) button and contains hex-escaped JavaScript. Clicking the button routes the victim to a geofenced landing page masquerading as a tax document or installer source; the page performs server-side environmental checks (IP address, browser language, timezone, screen resolution, rendering behavior, and font enumeration) and blocks requests containing VPN-related keywords, serving either an error or the next-stage download depending on the check outcome.

Successful checks deliver a VBS downloader that mixes benign function calls with malicious logic, extracts a steganographic image disguised as a PDF icon, decodes an embedded ZIP archive from the image, and drops the Ousaban payload to C:\SysMain_5874288 before self-deleting. Ousaban establishes persistence via a "Financeiro" value under the Registry Run key, tracks execution timestamps in a maisum.dat file, and decrypts a hardcoded list of 13+ targeted Spanish and Portuguese banks (including Banco Santander, BBVA, CaixaBank, Bankinter, and Caixa Geral de Depósitos) using the same custom XOR-plus-offset algorithm documented in the Casbaneiro Trojan. Once active, it provides keylogging, clipboard injection, screenshot capture, fake on-screen message generation, and full remote mouse/keyboard control to the operator.

Command and control uses DDNS subdomains that rotate daily, computed as a hardcoded "aki" prefix concatenated with the first eight characters of an MD5 hash derived from a fixed secret string and the current date; the malware fetches the current date via an intentional request to a Google Automated Queries page. Configuration and decoy data are staged on Pastebin, consistent with the broader Ousaban family's documented history of abusing legitimate cloud services (Amazon S3, Google Docs, Google Cloud Run) for payload hosting and C2 configuration retrieval in earlier LATAM-focused campaigns dating back to at least 2021.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1218.007 Msiexec
- T1547.001 Registry Run Keys / Startup Folder
- T1027.003 Steganography
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 System Checks
- T1070.004 File Deletion
- T1036.005 Match Legitimate Resource Name or Location
- T1056.001 Keylogging
- T1113 Screen Capture
- T1568.002 Domain Generation Algorithms
- T1102.001 Dead Drop Resolver
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Ousaban Persistence via Financeiro Registry Run Key and SysMain_5874288 Payload Drop** (`TL-2026-2305-SPL-002`)

Detects the post-exploitation footprint of an active Ousaban infection: creation of the "Financeiro" value under the Registry Run key, file drops to the hardcoded C:\SysMain_5874288 staging directory or the maisum.dat execution-timestamp tracker, matching payload/MSI SHA256 hashes, and msiexec.exe invoked as a system-binary-proxy from a scripting host — any one of these confirms the trojan has installed and is preparing to run.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1547.001, T1027.003, T1140, T1070.004, T1036.005, T1218.007
- **Data sources:** sysmon (Event ID 1/11/13), Microsoft Defender for Endpoint DeviceRegistryEvents/DeviceFileEvents/DeviceProcessEvents
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon
  (EventCode=13 TargetObject="*\\CurrentVersion\\Run\\Financeiro")
  OR (EventCode=11 (TargetFilename="C:\\SysMain_5874288\\*" OR TargetFilename="*\\maisum.dat"))
  OR (EventCode=11 Hashes IN ("*21b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd*","*d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3*","*ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c*","*18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e*","*4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb*","*5837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d*","*e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14*"))
  OR (EventCode=1 Image="*\\msiexec.exe" ParentImage IN ("*\\wscript.exe","*\\cscript.exe"))
| eval detection_reason=case(
    EventCode=13, "registry_run_key_financeiro",
    EventCode=11 AND like(TargetFilename,"%SysMain_5874288%"), "payload_drop_sysmain",
    EventCode=11 AND like(TargetFilename,"%maisum.dat%"), "timestamp_tracking_file",
    EventCode=11, "known_payload_msi_hash_match",
    EventCode=1, "msiexec_proxy_execution_from_script")
| stats count values(detection_reason) as reasons values(TargetObject) as registry_keys values(TargetFilename) as files values(CommandLine) as commands earliest(_time) as first_seen latest(_time) as last_seen by Computer, User
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
```

### Microsoft KQL

```kql
let PayloadHashes = dynamic(["21b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd","d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3","ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c","18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e","4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb","5837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d","e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14"]);
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and RegistryValueName == "Financeiro"
| project Timestamp, DeviceName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FolderPath has "SysMain_5874288" or FileName =~ "maisum.dat" or SHA256 in~ (PayloadHashes)
    | project Timestamp, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256
)
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "msiexec.exe" and InitiatingProcessFileName in~ ("wscript.exe","cscript.exe")
    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
)
```

### Sigma

```yaml
title: Ousaban Post-Exploitation Registry Persistence and Payload Drop
id: b2e4d9ef-7c3b-4fae-ad42-8064c9f5b211
status: experimental
description: Detects the Ousaban banking Trojan's persistence and installation footprint via its distinctive "Financeiro" Registry Run value, the C:\SysMain_5874288 staging path, the maisum.dat timestamp tracker, or matching payload/MSI SHA256 hashes.
references:
    - https://www.fortinet.com/blog/threat-research/analysis-of-ongoing-ousaban-attacks-targeting-the-iberian-peninsula
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-03
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.defense-evasion
    - attack.t1036.005
    - attack.t1218.007
    - attack.tool.ousaban
logsource:
    category: registry_set
    product: windows
detection:
    selection_registry:
        TargetObject|endswith: '\CurrentVersion\Run\Financeiro'
    selection_path:
        TargetFilename|contains:
            - 'C:\SysMain_5874288\'
            - '\maisum.dat'
    selection_hash:
        Hashes|contains:
            - '21B24F7EE1F6BDBBB670F0394D66009EE0DAA8CED57048298DA715E88F7A7CDD'
            - 'D4EB4FF02DF659FDEEC17D36B77084627469623BB3C7D16383D257404B52D1C3'
            - 'FFB9EB47CC0CB2F43E04A10DC84DF13D04BCA1EBACBE47FAD0B669728DE2F59C'
    condition: 1 of selection_*
falsepositives:
    - None expected for the exact "Financeiro" value name or the SysMain_5874288 path, which are campaign-specific artifacts and not standard Windows/Sysmain naming
level: critical
```

**Known false positives:**

- Legitimate financial/accounting software occasionally using generic Portuguese-language value names — verify against the exact literal "Financeiro" plus the co-occurring SysMain_5874288/maisum.dat artifacts before escalating

**Tuning notes:** TL_OSINT_Scan community corroboration (single sighting, reporter malwrhunterteam) tags payload hash d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3 with the external label "RustyStealer" rather than Ousaban — treat this as low-confidence OSINT corroboration, not a reclassification; investigate any hit on that specific hash for secondary/unrelated tooling before triaging it purely as Ousaban. This is behavioral/artifact-based rather than signature-based, so it survives binary repacking as long as the registry value name and staging path stay constant across campaign waves.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Ousaban Geofenced Landing Page Visit After PDF Lure Click-Through (locked: unlock with TL Creds)
- Ousaban Msiexec Proxy Execution and Local Data-Staging Behavior (locked: unlock with TL Creds)
- Ousaban DNS/Network Beacon to "aki"-Prefixed DuckDNS Domain Generation Pattern (locked: unlock with TL Creds)
- Ousaban VBS Downloader Extracting Steganographic Payload (locked: unlock with TL Creds)
- Ousaban "Financeiro" Registry Run Key Creation (locked: unlock with TL Creds)
- Ousaban Pastebin Dead-Drop Resolver Access from Scripting/Payload Process (locked: unlock with TL Creds)
- Ousaban Phishing PDF Lure with Hex-Escaped JavaScript and "Atualizar" Update Button (locked: unlock with TL Creds)
- Ousaban Daily-Rotating DDNS C2 Beaconing and Pastebin Dead-Drop Configuration Retrieval (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `213.159.64[.]191`
- Domain: `faturanova[.]xyz`
- File hash: `6bc2e11b0917f47d0557288c4f0cb20bd7589185943b989a969fdc6d3704ee73`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula](https://www.fortinet.com/blog/threat-research/analysis-of-ongoing-ousaban-attacks-targeting-the-iberian-peninsula)
- [Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures](https://thehackernews.com/2026/07/ousaban-banking-trojan-targets-iberian.html)
- [Ousaban: LATAM Banking Malware Abusing Cloud Services](https://www.netskope.com/blog/ousaban-latam-banking-malware-abusing-cloud-services)
- [Astaroth, Mekotio & Ousaban abusing Google Cloud Run in LATAM-focused malware campaigns](https://blog.talosintelligence.com/google-cloud-run-abuse/)
- [Ousaban: Private photo collection hidden in a CABinet](https://www.welivesecurity.com/2021/05/05/ousaban-private-photo-collection-hidden-cabinet/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2305