OusabanMalware
Last reported 22 days ago, by Group-IB4 reports
ATT&CK techniques
6 of 24 · each with the sentence it comes from- T1010Application Window Discovery
“T1010”
- T1012Query Registry
“T1012”
- T1016System Network Configuration Discovery
“T1016”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing”
- T1027.002Software Packing
“T1027.002”
- T1046Network Service Discovery
“T1046”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino“…ic Script (VBS) que descargan la siguiente etapa del ataque y que, además, presentan coincidencias con una muestra del troyano bancario Ousaban distribuida desde este dominio.”
-
Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers“Casbaneiro uses the same decryption algorithm as Ousaban.”
-
Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem“…ng with this domain reveals several Visual Basic Script (VBS) files that download the next stage of the attack and also overlap with an Ousaban banking trojan sample delivered from this domain.”
-
Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula“Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula”
Indicators in its reports
named in the reports above- caixaentradas1inboxshop[.]sitein 2 reports
- caixaentradas1boxshop[.]sitein 2 reports
- c2.installscenter[.]comin 2 reports
- infect[.]onlinein 2 reports
- 38.242.246[.]176in 2 reports
- installscenter[.]comin 2 reports
- hxxps://pastebin[.]com/raw/aF0WCxiain 2 reports
- hxxps://pastebin[.]com/raw/hM0nXNBPin 2 reports
- hxxps://pastebin[.]com/raw/9ChwVzzwin 2 reports
- infectonline[.]storein 2 reports
- f775fe06a4c2563c…cee7972e6b17in 2 reports
- 54e313434a7f3fa3…cdd9fabf2700in 2 reports
- 91f225dcc7a01f92…02ce638fa6b0in 2 reports
- cd8fc8effea20d28…41d51b6f6c78in 2 reports
- d881a60ccd03b541…65843643af99in 2 reports
- 0fa785bb9f95b113…2d85746fc5bfin 2 reports
- 1510823e7c80b4db…2e1c5cf30246in 2 reports
- 96960409b6e1abf2…d5aa56579042in 2 reports
- 0cd0cc49ea4ff48c…7f70bb6c0d5din 2 reports
- 30af2ec2437af0f4…a7a781c1e2fein 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.