Javali

Ousaban is delivered through malicious MSI files spread in phishing emails.

The content repeatedly describes threat actors and malware being delivered through phishing or spearphishing emails containing malicious attachments such as Microsoft Office documents, PDFs, RAR/ZIP archives, CHM, ISO, IMG, HTA, LNK, and executable files disguised as documents.

Multiple actors and malware families are described as being delivered via spearphishing/phishing emails containing malicious links (e.g., APT28 used URL shorteners to redirect to credential harvesting sites; APT29 used links to ZIP files; APT33 used links to .hta files; BlackTech used links to cloud services; Wizard Spider used links to Google Drive/free file hosting).

Executes the main file via WMIC.

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

In the first scenario, the JavaScript is executed via CustomAction. The JavaScript code is obfuscated, likely in an attempt to slow down analysis.

has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.

has used malicious files including VBS, LNK, and HTML for execution... has sent malicious files requiring direct victim interaction to execute... has used malicious .exe or .dll files disguised as documents or images.

“avisoProtesto.exe” is a signed and non-malicious binary exploited to execute the malicious DLL via DLL search order hijacking.

Once running, Ousaban adds a registry entry named Financeiro (Portuguese for "finance") so it starts up with Windows.

Once running, Ousaban adds a registry entry named Financeiro (Portuguese for "finance") so it starts up with Windows.

The JavaScript code is obfuscated, likely in an attempt to slow down analysis... Aside from decrypting the payload, the second stage also decrypts the code that will execute Ousaban in runtime, probably to slow down reverse engineering... Ousaban commonly packs/protects its payloads with UPX or Enigma.

Ousaban commonly packs/protects its payloads with UPX or Enigma.

A script downloads an image that looks like a PDF icon but hides a ZIP file inside, a trick called steganography.

Important API calls used by this stage are also dynamically resolved, another common technique to slow down reverse engineering.

The script unpacks Ousaban from that ZIP, runs it, then deletes the image, the ZIP, and itself to leave less behind.

“avisoProtesto.exe” is a signed and non-malicious binary exploited to execute the malicious DLL via DLL search order hijacking.

Creates an empty file to be used as a flag in case the MSI is executed twice (similar concept as Mutex usage);

“avisoProtesto.exe” is a signed and non-malicious binary exploited to execute the malicious DLL via DLL search order hijacking.

When a target bank loads, it can capture screenshots and keystrokes, tamper with the clipboard, show fake messages, and give the attacker remote control.

Agent Tesla can gather credentials from a number of browsers... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge... SELECT action_url, username_value, password_value FROM logins; CryptUnprotectData

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

Like other Brazilian-sourced malware, Ousaban monitors the title text from the active window and compares it with a list of strings, to verify if the victim is accessing the website or an application of one of its targets.

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

Sends a simple GET request to another URL (Azure or another attacker-controlled server), alerting the attacker and logging the victim’s IP;

Creates an empty file to be used as a flag in case the MSI is executed twice (similar concept as Mutex usage);

When a target bank loads, it can capture screenshots and keystrokes, tamper with the clipboard, show fake messages, and give the attacker remote control.

When a target bank loads, it can capture screenshots and keystrokes, tamper with the clipboard, show fake messages, and give the attacker remote control.

When a target bank loads, it can capture screenshots and keystrokes, tamper with the clipboard, show fake messages, and give the attacker remote control.

When a target bank loads, it can capture screenshots and keystrokes, tamper with the clipboard, show fake messages, and give the attacker remote control.

The binary downloaded from the cloud is a ZIP file containing the next stage payload

the threat often abuses cloud services, such as Amazon S3 to download second stage payloads, and Google Docs to retrieve the C2 configuration... the malware is using Pastebin to fetch the data... contain a routine to communicate via Telegram using Webhooks

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

If the window title matches one of the targets, Ousaban starts the communication with the C2 address, providing the option to the attacker to access the machine remotely.

This time, the real server moves every day. The malware reads the current date off a Google page, builds a web address from that date plus a fixed secret, and looks it up.