Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula

    Thursday, July 2, 2026 In: Threat Research Print

    Date: 07/02/2026

    Severity: High

    Summary

    In May 2026, Threat Labs detected an Ousaban banking Trojan campaign targeting Spain and Portugal. The malware, historically active in Brazil, is delivered using a malicious MSI downloader. Phishing PDFs trick victims into visiting a webpage that scans their geographic location. If the user is in the target region, the site downloads an initial VBS script. This VBS script then drops and executes the final malicious EXE payload. The threat actor utilizes DLL side-loading or process injection to run the payload.

    Indicators of Compromise (IOC) List

    Domains/URLs

    faturanova.xyz

    facture-in.pages.dev

    facture-arsys.duckdns.org

    faturanova.duckdns.org

    controlfacturas.site

    IP Address 

    213.159.64.191

    162.33.179.46

    91.92.240.140

    78.40.209.32

    Hash 

    6bc2e11b0917f47d0557288c4f0cb20bd7589185943b989a969fdc6d3704ee73

    540ee1936e61d2344b5ebc93485589a351ec2f113a9b4940ae16f3baa4807392

    e2f0c2d4c1552cd81fa012043e4a5ac832582b639b7b6b7eccc0c4802d7a8ad8

    9d07a83cf89685651ea8992047ae694c24f6ddef193044357debd15ce07a64fe

    4c9fdc2823da505ef339d43c6ad38499b7e3447736733e42b5ab6b1afcfd42aa

    5e06af187b45476ade0d953e834fced6197d0a33ac60c2575877660e26ab15e8

    65c1a998bac48e02b52b1c850cd500e9fb87521e21755c3a4a491243f5f9a700

    9e81ade09cc18f0fc09d73e72d2e0bffad02f52fdcc26553e473cee8cabc1567

    1e77992666acbbfa0d01fcefa9cc8fbdac291e0681b35745be27c6dfb159a375

    fadbb8061715128bebecf7bc59132b6bb04fe8cc39b965aa5b8722dffe28d7e7

    5a2ed557c357ba8f96f2d55a8a00695987806b5df766cd1dfdab0cbed111774a

    19ac18a50abb48dc0ea9524850acfaec49359e6b3bcc67c6193c2d56da812c71

    48723a33bab89f174750576f9a62da35b3b9e5ac31a5a8f1ce9859a1b35bf8b8

    21b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd

    d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3

    ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c

    18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e

    4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb

    5837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d

    e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "controlfacturas.site" or url like "controlfacturas.site" or siteurl like "controlfacturas.site" or domainname like "facture-in.pages.dev" or url like "facture-in.pages.dev" or siteurl like "facture-in.pages.dev" or domainname like "facture-arsys.duckdns.org" or url like "facture-arsys.duckdns.org" or siteurl like "facture-arsys.duckdns.org" or domainname like "faturanova.xyz" or url like "faturanova.xyz" or siteurl like "faturanova.xyz" or domainname like "faturanova.duckdns.org" or url like "faturanova.duckdns.org" or siteurl like "faturanova.duckdns.org"

    Detection Query 2 :

    dstipaddress IN ("78.40.209.32","162.33.179.46","91.92.240.140","213.159.64.191") or srcipaddress IN ("78.40.209.32","162.33.179.46","91.92.240.140","213.159.64.191")

    Detection Query 3 :

    sha256hash IN ("18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e","48723a33bab89f174750576f9a62da35b3b9e5ac31a5a8f1ce9859a1b35bf8b8","e2f0c2d4c1552cd81fa012043e4a5ac832582b639b7b6b7eccc0c4802d7a8ad8","ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c","6bc2e11b0917f47d0557288c4f0cb20bd7589185943b989a969fdc6d3704ee73","4c9fdc2823da505ef339d43c6ad38499b7e3447736733e42b5ab6b1afcfd42aa","9d07a83cf89685651ea8992047ae694c24f6ddef193044357debd15ce07a64fe","1e77992666acbbfa0d01fcefa9cc8fbdac291e0681b35745be27c6dfb159a375","5e06af187b45476ade0d953e834fced6197d0a33ac60c2575877660e26ab15e8","9e81ade09cc18f0fc09d73e72d2e0bffad02f52fdcc26553e473cee8cabc1567","21b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd","d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3","5a2ed557c357ba8f96f2d55a8a00695987806b5df766cd1dfdab0cbed111774a","540ee1936e61d2344b5ebc93485589a351ec2f113a9b4940ae16f3baa4807392","4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb","5837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d","e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14","fadbb8061715128bebecf7bc59132b6bb04fe8cc39b965aa5b8722dffe28d7e7","65c1a998bac48e02b52b1c850cd500e9fb87521e21755c3a4a491243f5f9a700","19ac18a50abb48dc0ea9524850acfaec49359e6b3bcc67c6193c2d56da812c71")

    Reference:    

    https://www.fortinet.com/blog/threat-research/analysis-of-ongoing-ousaban-attacks-targeting-the-iberian-peninsula 


    Tags

    BrazilMalwareTrojanFinancial ServicesSpainPortugalDLLPhishing

    « Previous Article

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.