Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula

MITRE Techniques

• [T1566.003 ] Phishing: Spearphishing Link – The phishing PDF directs victims to a malicious webpage that begins the infection chain (‘Atualizar button links to a malicious webpage’).
• [T1204.002 ] User Execution: Malicious File – The victim is tricked into opening a disguised PDF and following the update prompt to continue the attack (‘disguised as a corrupted file’ and prompts the victim to update it).
• [T1027 ] Obfuscated Files or Information – The PDF JavaScript is hex-escaped and the malware uses encrypted strings and encoded traffic to hinder detection (‘This JavaScript code is hex-escaped to evade detection’ and ‘Most of the traffic… is encrypted’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The webpage checks language, time zone, IP, screen resolution, browser rendering, and fonts to block sandboxes and crawlers (‘identify and block automated tools, such as sandboxes and crawlers’).
• [T1036 ] Masquerading – The malicious webpage imitates legitimate tax documents and installers, and the PDF pretends to be corrupted (‘masquerades as a legitimate source of tax documents’ and ‘disguised as a corrupted file’).
• [T1105 ] Ingress Tool Transfer – The attack downloads VBS, ZIP, image, and EXE payloads from the malicious infrastructure (‘downloads a VBS file’ and ‘retrieves the Ousaban payload’).
• [T1027.003 ] Steganography – The VBS downloads a steganographic image that hides a ZIP file containing the payload (‘downloads a steganographic image’ and ‘extracts a ZIP file from the image’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – The malware uses webpages, Pastebin, Google Automated Queries, and browser-based requests to retrieve environment and C2-related data (‘accesses the same webpage’ and ‘looks up a hostname’).
• [T1090.001 ] Proxy: Internal Proxy – The anti-analysis code blocks VPN-linked IPs by searching for VPN-related keywords in organization info (‘blocks IP addresses linked to VPNs’).
• [T1057 ] Process Discovery – The environment checks inspect running/browser behavior and device characteristics to determine whether the user is automated or real (‘browser rendering, and font enumeration’).
• [T1016 ] System Network Configuration Discovery – The webpage and malware verify language, time zone, and IP details to identify the victim’s location (‘verifies language, time zone, and IP details’).
• [T1497 ] Virtualization/Sandbox Evasion – The malware detects restricted environments and serves an error or fake file when checks fail (‘if the user doesn’t pass the environment check’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Ousaban creates a Run key value for persistence (‘creates a registry value named Financeiro in the CurrentVersion/Run registry key’).
• [T1005 ] Data from Local System – The malware collects victim environment data and browser/device information before deciding delivery (‘Environmental information is sent to the threat actor’).
• [T1568.002 ] Dynamic Resolution: Domain Generation Algorithms – The C2 hostname changes daily based on date-derived MD5 data (‘hostnames change daily’ and ‘subdomains consist of… the first eight characters of an MD5 hash’).
• [T1033 ] System Owner/User Discovery – The malware gathers user/system details to profile the victim and tailor its response (‘Collect user information’).
• [T1056.001 ] Input Capture: Keylogging – The C2 command list includes keylogger functionality during remote-control setup (‘implementing a keylogger’).
• [T1115 ] Clipboard Data – The malware supports clipboard injection as part of victim interaction (‘performing clipboard injection’).
• [T1021 ] Remote Services – The malware enables remote control capabilities over the victim machine (‘Start screenshot capture and remote control capability’).