Ousaban Banking Trojan Targets Iberian Users

The Ousaban banking trojan has resurfaced with a refined campaign targeting users in Spain and Portugal through malicious PDF attachments. This malware employs advanced evasion techniques, keylogging capabilities, and remote access functionalities to steal banking credentials and financial data. The trojan uses social engineering tactics disguised as legitimate financial documents to compromise victims, representing a significant threat to Iberian Peninsula banking customers.

Introduction

Financial institutions in Spain and Portugal are facing renewed pressure from cybercriminals wielding the Ousaban banking trojan, a sophisticated malware variant specifically designed to compromise online banking sessions. Recent campaigns have leveraged fake PDF documents as initial infection vectors, tricking users into executing malicious payloads that grant attackers complete control over victim systems.

This latest iteration demonstrates significant evolution in the trojan’s capabilities, including enhanced anti-analysis features, improved credential harvesting mechanisms, and more sophisticated command-and-control (C2) infrastructure. The targeting of Iberian Peninsula users suggests a focused effort by threat actors familiar with regional banking systems and customer behaviors.

Background & Context

Ousaban first emerged in the threat landscape as a banking trojan targeting Portuguese-speaking users, but has since expanded its scope to encompass broader Iberian targets. The malware family shares tactical similarities with other Latin American banking trojans, suggesting possible connections to established cybercrime groups operating in these regions.

Banking trojans remain among the most lucrative malware categories for cybercriminals, with the financial services sector experiencing consistent targeting. The Iberian Peninsula has become an attractive target due to the widespread adoption of online banking services combined with varying levels of cybersecurity awareness among users.

Previous Ousaban campaigns utilized phishing emails with malicious links, but the shift to weaponized PDF attachments represents an evolution in delivery methodology. This approach exploits user trust in PDF documents as “safe” file formats, increasing the likelihood of successful infection.

Technical Breakdown

The Ousaban infection chain begins with spear-phishing emails containing PDF attachments that masquerade as legitimate banking documents, invoices, or financial statements. These PDFs contain embedded links or scripts that, when activated, download the initial dropper component.

Infection Sequence

The malware deployment follows this multi-stage process:

• Initial Compromise: User opens malicious PDF and clicks embedded link
• Dropper Execution: MSI installer or executable downloads from compromised or attacker-controlled infrastructure
• Payload Deployment: Main trojan module installs with persistence mechanisms
• C2 Establishment: Beacon communication initiated to attacker infrastructure

Persistence Mechanisms

Ousaban establishes persistence through multiple registry modifications:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

The malware also creates scheduled tasks to ensure execution survives system reboots:

schtasks /create /tn "SystemUpdate" /tr "C:\Users\[USER]\AppData\Local\Temp\[random].exe" /sc onlogon /rl highest

Core Capabilities

Ousaban’s functional modules include:

• Keylogging: Captures all keyboard input including credentials and sensitive data
• Screen Capture: Takes periodic screenshots during banking sessions
• Form Grabbing: Intercepts POST data from web browsers before encryption
• Remote Access: Full backdoor capabilities allowing manual interaction
• Browser Manipulation: Injects malicious JavaScript into banking websites
• Anti-VM Detection: Checks for virtualized environments to evade analysis

Evasion Techniques

The trojan implements several anti-analysis measures:

# Pseudocode of VM detection routine
if detect_vmware() or detect_virtualbox() or detect_sandbox():
    terminate_process()
    delete_self()

String obfuscation, API hashing, and dynamic code loading further complicate static analysis efforts. The malware also monitors for debugging tools and security software, terminating execution if detected.

Impact & Risk Assessment

Financial Impact

The primary risk involves direct financial theft through credential compromise and unauthorized transactions. Ousaban’s real-time web injection capabilities allow attackers to manipulate banking sessions while victims are actively logged in, bypassing many two-factor authentication mechanisms.

Data Exposure

Beyond immediate financial theft, victims face risks of:

• Complete credential compromise for multiple services
• Personal identification document theft
• Email account takeover enabling further attacks
• Corporate network access if used on business systems

Organizational Risk

For businesses, a single infected endpoint can serve as a pivot point for lateral movement, potentially exposing entire corporate networks. The keylogging functionality captures sensitive business communications and proprietary information.

Scale of Threat

While precise infection numbers remain unknown, telemetry from security vendors indicates hundreds of attempted infections across Spain and Portugal monthly. The focused regional targeting suggests a campaign designed for maximum effectiveness within specific banking ecosystems.

Vendor Response

Major antivirus vendors have updated signatures to detect known Ousaban variants. Microsoft Defender, ESET, Kaspersky, and other security solutions now identify the malware across its execution stages.

Spanish and Portuguese banking institutions have issued security advisories to customers, warning about suspicious PDF attachments and reinforcing safe banking practices. Several banks have implemented additional transaction verification steps for customers accessing accounts from new or suspicious devices.

CERT-EU and national CERTs in both countries have published threat intelligence reports containing indicators of compromise (IOCs) and recommended defensive measures for organizations.

Security researchers continue reverse-engineering new samples to identify infrastructure, attribution indicators, and potential connections to other malware families or threat groups.

Mitigations & Workarounds

Immediate Actions

Organizations and individuals should implement these protective measures:

Email Security:

• Block executable attachments at email gateway
• Implement advanced threat protection with sandbox analysis
• Enable SPF, DKIM, and DMARC for email authentication

Endpoint Protection:

# Enable Windows Defender real-time protection
Set-MpPreference -DisableRealtimeMonitoring $false


# Update signatures
Update-MpSignature

# Run full system scan
Start-MpScan -ScanType FullScan

Browser Security:

• Use dedicated browsers for banking activities only
• Clear browser cache and cookies regularly
• Disable automatic PDF handling in browsers

Application Whitelisting

Implement application control policies:

# Example AppLocker rule to block execution from temp directories
$rule = New-AppLockerPolicy -RuleType Path -Path "C:\Users\\AppData\Local\Temp\" -Action Deny -User Everyone
Set-AppLockerPolicy -PolicyObject $rule

Detection & Monitoring

Network Indicators

Monitor for suspicious outbound connections:

IP ranges associated with known C2 infrastructure
Unusual HTTPS connections to recently registered domains
Beaconing patterns with regular intervals

Host-Based Indicators

# Check for suspicious registry modifications
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

# Monitor suspicious scheduled tasks
schtasks /query /fo LIST /v | findstr "Temp"

# Review suspicious processes
Get-Process | Where-Object {$_.Path -like "\AppData\Local\Temp\"}

SIEM Detection Rules

Implement correlation rules detecting:

• PDF file download followed by executable creation within 5 minutes
• Registry Run key modification by non-system processes
• Unusual browser subprocess creation
• Repeated authentication failures to banking domains

Best Practices

User Education

Organizations must prioritize security awareness training covering:

• Recognition of phishing attempts and social engineering
• Safe handling of email attachments
• Verification procedures for financial communications
• Reporting procedures for suspicious activity

Defense in Depth

Layer security controls:

• Perimeter: Email filtering, web gateway protection
• Network: IDS/IPS, network segmentation
• Endpoint: EDR solutions, application whitelisting
• Data: Encryption, DLP policies
• Identity: MFA, privileged access management

Incident Response Preparedness

Maintain updated incident response procedures specifically for banking trojan infections:

• Immediate account credential resets
• Transaction monitoring and fraud detection activation
• Forensic evidence preservation
• Stakeholder communication protocols

Regular Security Hygiene

# Automated update script
# Update operating system
Install-WindowsUpdate -AcceptAll -AutoReboot

# Update applications
winget upgrade --all

# Clear temporary files
Remove-Item -Path "$env:TEMP\*" -Recurse -Force -ErrorAction SilentlyContinue

Key Takeaways

• Ousaban represents a significant threat to Iberian banking customers through sophisticated credential theft mechanisms
• PDF-based lures exploit user trust in “safe” document formats to achieve initial compromise
• Multi-layered detection and prevention strategies are essential for effective defense
• User awareness remains a critical component in preventing successful infections
• Organizations must maintain current threat intelligence to adapt defenses against evolving tactics
• Banking customers should verify all financial communications through official channels before interacting with attachments
• Regular security updates and endpoint protection significantly reduce infection risk

References

• CERT-EU Threat Intelligence Report: Ousaban Banking Trojan Analysis
• Spanish National Cybersecurity Institute (INCIBE) Security Advisory
• Portuguese National Cybersecurity Centre Warning Notice
• MITRE ATT&CK Framework: T1056.001 (Input Capture: Keylogging)
• MITRE ATT&CK Framework: T1539 (Steal Web Session Cookie)
• VirusTotal IOC Repository: Ousaban Sample Collection
• Banking Security Consortium: Financial Malware Trends Q4 2024

Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/