# Ousaban Banking Trojan Campaign Targeting Banking Users in Spain and Portugal

> FortiGuard Labs analyzes an ongoing Ousaban (Javali) banking Trojan campaign against users in Spain and Portugal. Phishing PDFs lead to geofenced malicious pages, VBS downloaders fetch steganographic images with an embedded ZIP payload, and C2 uses daily-rotating DDNS subdomains.

- **Published:** 2026-10-26T16:22:36Z
- **Last reviewed:** 2026-10-26T16:22:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4462
- **ID:** TL-2026-4462
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Ousaban (also tracked as Javali) is a Brazilian-origin banking Trojan belonging to the Latin American family cluster that Kaspersky labeled the 'Tetrade' (Grandoreiro, Guildma, Melcoz, Javali/Ousaban). FortiGuard Labs identified an ongoing campaign in May 2026 and published its analysis on 2026-07-01, describing attacks on banking users in Spain and Portugal. Targeted institutions reported by press coverage of the research include Banco Santander, BBVA, CaixaBank, Bankinter and Caixa Geral de Depositos; the target-bank list is stored encrypted inside the payload.

The infection chain begins with a phishing PDF disguised as a corrupted file with an 'Atualizar' (Update) button; the PDF embeds hex-escaped JavaScript. The button directs the victim to a malicious webpage that performs geofencing and environment checks: IP/device verification of language, timezone and location, blocking of VPNs (keyword 'vpn' in organization info), screen resolution, browser rendering and font enumeration, and blocking of sandboxes and crawlers. Newer variants move the validation server-side to hide the criteria; when checks fail the page randomly (about 50%) shows an error or serves a file download. Passing victims receive a VBS downloader containing benign filler function calls, which fetches an image resembling a PDF icon that steganographically embeds a ZIP archive. The script extracts the ZIP to C:\SysMain_5874288, executes the Ousaban payload, and deletes the image, ZIP and VBS files to reduce forensic footprint.

The payload persists through a registry value named 'Financeiro' under CurrentVersion\Run and uses a marker file maisum.dat whose creation time serves as the install timestamp. Strings and network traffic are protected by a custom encryption algorithm (random first-byte base offset, subsequent bytes XORed with a key with the offset subtracted, adding 0xFF on underflow) shared with other Latin American banking Trojans such as Casbaneiro. A Pastebin-hosted configuration decrypts to a private IP address and acts as a decoy. The real C2 is resolved through daily-changing DDNS hostnames built as 'aki' plus the first 8 characters of an MD5 of a hard-coded string concatenated with the current date; the date is obtained by deliberately visiting the Google automated-queries page. The C2 command set includes #Convite# (collect user information), #Handle# (assign victim ID), #ON-LINE# (heartbeat), #xyScree# (screen resolution request) and #Iniciar# (screenshot capture, remote control, keylogging, clipboard injection).

Fortinet also describes an earlier (late 2025) variant with two entry points: a ClickFix lure leading to a VBS and then an MSI installer, and a PDF lure leading to a phishing page and an MSI installer, where the MSI is a Rust-based downloader that executes the Ousaban payload. Earlier campaigns stored configuration in Google Docs. No CVE is involved and no threat actor beyond the malware family is attributed in the sources. A BeaconBeagle lookup for 213.159.64.191 returned no record (HTTP 404). Fortinet detection names: W32/Ousaban.EY!tr.spy, VBS/Agent.TPX!tr.dldr, PDF/Agent.STG!tr.

## MITRE ATT&CK

- T1583.001 Domains
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1204.001 Malicious Link
- T1140 Deobfuscate/Decode Files or Information
- T1071 Application Layer Protocol
- T1059.005 Visual Basic
- T1547.001 Registry Run Keys / Startup Folder
- T1027.003 Steganography
- T1480 Execution Guardrails
- T1497.001 System Checks
- T1070.004 File Deletion
- T1036.008 Masquerade File Type
- T1056.001 Keylogging
- T1113 Screen Capture
- T1568.002 Domain Generation Algorithms
- T1573.001 Symmetric Cryptography

## Sources

- [Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula (FortiGuard Labs)](https://www.fortinet.com/blog/threat-research/analysis-of-ongoing-ousaban-attacks-targeting-the-iberian-peninsula)
- [Ousaban Banking Trojan Targets Iberian Banking Users (The Hacker News)](https://thehackernews.com/2026/07/ousaban-banking-trojan-targets-iberian.html)
- [Ousaban banking trojan Spain Portugal fake PDF (The Next Web)](https://thenextweb.com/news/ousaban-banking-trojan-spain-portugal-fake-pdf)
- [Banking Malware with Steganography: What the Ousaban Case Teaches Brazil (Intelliway)](https://www.intelliway.com.br/blog/2026-05-21-malware-bancario-com-esteganografia-o-que-o-caso-ousaban-ens)
- [Brazilian Banking Trojan Ousaban Crosses the Atlantic With PDF Tricks and Hidden Payloads (WebProNews)](https://www.webpronews.com/brazilian-banking-trojan-ousaban-crosses-the-atlantic-with-pdf-tricks-and-hidden-payloads/)
- [Ousaban widens banking threat across Iberia (The Arabian Post)](https://thearabianpost.com/ousaban-widens-banking-threat-across-iberia/)
- [Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula (OffSeq Radar)](https://radar.offseq.com/threat/analysis-of-ongoing-ousaban-attacks-targeting-the--a1c8d4caeba03d14)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4462