¡La inscripción ya está abierta para SASE Week 2023! Inscríbete en la lista de invitados.

  • Servicio de seguridad Productos Edge

    Protéjase contra las amenazas avanzadas y en la nube y salvaguarde los datos en todos los vectores.

  • Borderless SD-WAN

    Proporcione con confianza un acceso seguro y de alto rendimiento a cada usuario remoto, dispositivo, sitio y nube.

La plataforma del futuro es Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) y Private Access for ZTNA integrados de forma nativa en una única solución para ayudar a todas las empresas en su camino hacia el Servicio de acceso seguro Arquitectura perimetral (SASE).

Todos los productos
Vídeo de Netskope
Borderless SD-WAN: el comienzo de la nueva era de la empresa sin fronteras

Netskope Borderless SD-WAN offers an architecture that converges zero trust principles and assured application performance to provide unprecedented secure, high-performance connectivity for every site, cloud, remote user, and IoT device.

Leer el artículo
Borderless SD-WAN
Adopte una arquitectura de borde de servicio de acceso seguro (SASE)

Netskope NewEdge es la nube privada de seguridad más grande y de mayor rendimiento del mundo y ofrece a los clientes una cobertura de servicio, un rendimiento y una resiliencia incomparables.

Más información sobre NewEdge
NewEdge
Tu red del mañana

Planifique su camino hacia una red más rápida, más segura y más resistente diseñada para las aplicaciones y los usuarios a los que da soporte.

Obtenga el whitepaper
Tu red del mañana
Netskope Cloud Exchange

Cloud Exchange (CE) de Netskope ofrece a sus clientes herramientas de integración eficaces para que saquen partido a su inversión en estrategias de seguridad.

Más información sobre Cloud Exchange
Vídeo de Netskope
Cambie a los servicios de seguridad en la nube líderes del mercado con una latencia mínima y una alta fiabilidad.

Más información sobre NewEdge
Lighted highway through mountainside switchbacks
Habilite de forma segura el uso de aplicaciones de IA generativa con control de acceso a aplicaciones, capacitación de usuarios en tiempo real y la mejor protección de datos de su clase.

Descubra cómo aseguramos el uso generativo de IA
Habilite de forma segura ChatGPT y IA generativa
Soluciones de confianza cero para implementaciones de SSE y SASE

Más información sobre Confianza Cero
Boat driving through open sea
Netskope hace posible un proceso seguro, rápido y con inteligencia cloud para la adopción de los servicios en la nube, las aplicaciones y la infraestructura de nube pública.

Más información sobre soluciones industriales
Wind turbines along cliffside
  • Recursos

    Obtenga más información sobre cómo Netskope puede ayudarle a proteger su viaje hacia la nube.

  • Blog

    Descubra cómo Netskope permite la transformación de la seguridad y las redes a través del servicio de seguridad (SSE).

  • Eventos & Workshops

    Manténgase a la vanguardia de las últimas tendencias de seguridad y conéctese con sus pares.

  • Seguridad definida

    Todo lo que necesitas saber en nuestra enciclopedia de ciberseguridad.

Podcast Security Visionaries

Leveling Up the SASE Conversation
Robert Arandjelovic and Gerry Plaza sit down to chat with Max Havey about how embracing a SASE journey can help bring networking and security teams closer together.

Reproducir el pódcast
Leveling Up the SASE Conversation
Últimos blogs

Cómo Netskope puede habilitar el viaje de Zero Trust y SASE a través de las capacidades del borde del servicio de seguridad (SSE).

Lea el blog
Sunrise and cloudy sky
SASE Week 2023: Your SASE journey starts now!

Únase a nosotros para la cuarta SASE Week anual, del 26 al 28 de septiembre.

Registrarse
SASE Week 2023
¿Qué es Security Service Edge (SSE)?

Explore el lado de la seguridad de SASE, el futuro de la red y la protección en la nube.

Más información sobre el servicio de seguridad perimetral
Four-way roundabout
  • Nuestros clientes

    Netskope da servicio a más de 2.000 clientes en todo el mundo, entre los que se encuentran más de 25 de las 100 empresas de Fortune

  • Soluciones para clientes

    Le apoyamos en cada paso del camino, garantizando su éxito con Netskope.

  • Comunidad de Netskope

    Aprenda de otros profesionales de redes, datos y seguridad.

  • Formación y certificación

    La formación de Netskope le ayudará a convertirse en un experto en seguridad en la nube.

Ayudamos a nuestros clientes a estar preparados para cualquier situación

Ver nuestros clientes
Woman smiling with glasses looking out window
El talentoso y experimentado equipo de servicios profesionales de Netskope proporciona un enfoque prescriptivo para su exitosa implementación.

Más información sobre servicios profesionales
Servicios profesionales de Netskope
La comunidad de Netskope puede ayudarlo a usted y a su equipo a obtener más valor de los productos y las prácticas.

Acceder a la Netskope Community
La comunidad de Netskope
Asegure su viaje de transformación digital y aproveche al máximo sus aplicaciones en la nube, web y privadas con la capacitación de Netskope.

Infórmese sobre Capacitaciones y Certificaciones
Group of young professionals working
  • Empresa

    Le ayudamos a mantenerse a la vanguardia de los desafíos de seguridad de la nube, los datos y la red.

  • Por qué Netskope

    La transformación de la nube y el trabajo desde cualquier lugar han cambiado la forma en que debe funcionar la seguridad.

  • Liderazgo

    Nuestro equipo de liderazgo está firmemente comprometido a hacer todo lo necesario para que nuestros clientes tengan éxito.

  • Partners

    Nos asociamos con líderes en seguridad para ayudarlo a asegurar su viaje a la nube.

Apoyar la sostenibilidad a través de la seguridad de los datos

Netskope se enorgullece de participar en Vision 2045: una iniciativa destinada a crear conciencia sobre el papel de la industria privada en la sostenibilidad.

Descubra más
Apoyando la sustentabilidad a través de la seguridad de los datos
La más Alta en Ejecución. Más Avanzada en Visión.

Netskope ha sido reconocido como Líder en el Gartner® Magic Quadrant™ de 2023 en SSE.

Obtenga el informe
Netskope ha sido reconocido como Líder en el Gartner® Magic Quadrant™ de 2023 en SSE.
Pensadores, constructores, soñadores, innovadores. Juntos, ofrecemos soluciones de seguridad en la nube de vanguardia para ayudar a nuestros clientes a proteger sus datos y usuarios.

Conozca a nuestro equipo
Group of hikers scaling a snowy mountain
La estrategia de venta centrada en el partner de Netskope permite a nuestros canales maximizar su expansión y rentabilidad y, al mismo tiempo, transformar la seguridad de su empresa.

Más información sobre los socios de Netskope
Group of diverse young professionals smiling

Ousaban: LATAM Banking Malware Abusing Cloud Services

Aug 04 2022

Resumen

Ousaban (a.k.a. Javali) is a banking malware that emerged between 2017 and 2018, with the primary goal of stealing sensitive data from financial institutions in Brazil. This malware is developed in Delphi and it comes from a stream of LATAM banking trojans sourced from Brazil, sharing similarities with other families like Guildma, Casbaneiro, and Grandoreiro. Furthermore, the threat often abuses cloud services, such as Amazon S3 to download second stage payloads, and Google Docs to retrieve the C2 configuration.

Netskope Threat Labs came across recent Ousaban samples that are abusing multiple cloud services throughout the attack flow, such as Amazon or Azure to download its payloads and log the victim’s IP, and Pastebin to retrieve the C2 configuration. The malware is downloaded through MSI files either by a JavaScript or a Delphi DLL, and is targeting more than 50 financial institutions in Brazil. Furthermore, we also found Telegram abuse in the malware code, likely used for C2 communication via Webhooks.

Diagram of Ousaban attack flow

In this blog post, we will analyze Ousaban, showing its delivery methods, obfuscation techniques, and C2 communication.

Delivery methods

Ousaban is delivered through malicious MSI files spread in phishing emails. In this campaign, we found that the MSI file downloads and executes the second stage either through JavaScript or a PE file.

Delivery by JavaScript
In the first scenario, the JavaScript is executed via CustomAction.

Example of MSI file executing JavaScript.
MSI file executing JavaScript.

The JavaScript code is obfuscated, likely in an attempt to slow down analysis.

Example of JavaScript code extracted from the MSI file
JavaScript code extracted from the MSI file

Looking at the deobfuscated code, these are the steps executed by the malware:

  1. Creates an empty file to be used as a flag in case the MSI is executed twice (similar concept as Mutex usage);
  2. Downloads the second stage from the cloud, either from Amazon or Azure;
  3. Decompress the ZIP file downloaded from the cloud and renames the main executable;
  4. Sends a simple GET request to another URL (Azure or another attacker-controlled server), alerting the attacker and logging the victim’s IP;
  5. Executes the main file via WMIC.
Screenshot of deobfuscated JavaScript extracted from the MSI file.
Deobfuscated JavaScript extracted from the MSI file.

Delivery by File

We also found Ousaban being delivered without JavaScript. In this case, we can see a file named “avisoProtesto.exe” being executed via MSI CustomAction.

Example of MSI executing a PE file.
MSI executing a PE file.

“avisoProtesto.exe” is a signed and non-malicious binary exploited to execute the malicious DLL via DLL search order hijacking.

Example of non-malicious binary used to load the malicious DLL.
Non-malicious binary used to load the malicious DLL.

This is possible because the non-malicious binary loads a DLL named “crashreport.dll” without specifying the real path of the library. Therefore, the attacker places a DLL with the same name in the same folder of the executable, making it load the malicious DLL instead.

Example of Binary vulnerable to DLL hijacking.
Binary vulnerable to DLL hijacking.

In this case, both next-stage and tracker URL are loaded from a text file, named “FileLinks”.

Screenshot of malicious URLs loaded by the malware.
Malicious URLs loaded by the malware.

All the files we analyzed were downloading the next stage from the cloud, either Amazon or Azure. In some cases, the URL used to log the victim’s IP address was also from Azure. All the URLs can be found in our GitHub repository.

Loading the second stage

The binary downloaded from the cloud is a ZIP file containing the next stage payload, which is a Delphi DLL executed by a non-malicious binary.

Example of Files downloaded from the cloud.
Files downloaded from the cloud.

The file executed by the malware is a non-malicious executable with a valid signature (“Securityo6Z3.exe”).

Screenshot of certificate found in the file executed by the malware.
Certificate found in the file executed by the malware.

The malicious DLL is then loaded by the non-malicious binary through a DLL search order hijacking vulnerability, the same technique that is used by some of the downloaders.

Example of non-malicious binary loading the next stage DLL.
Non-malicious binary loading the next stage DLL.

Second stage

The second stage is a Delphi malware responsible for decrypting and loading Ousaban’s payload in the following flow:

  1. Loads the encrypted bytes of Ousaban from disk;
  2. Decrypts Ousaban payload using a key stored in the “.data” section;
  3. Decrypts the code that runs Ousaban using the same key, stored in the “.data” section.
Example of decryption key and encrypted code stored in the “.data” section of the second stage
Decryption key and encrypted code stored in the “.data” section of the second stage.

The encrypted payload of Ousaban is located among the files downloaded from the cloud, named “ZapfDingbats.pdf”.

Example of third stage encrypted among files downloaded from the cloud.
Third stage encrypted among files downloaded from the cloud.

Once running, the second stage loads Ousaban’s encrypted bytes, which will be decrypted using the key stored in the PE “.data” section.

Screenshot of encrypted Ousaban payload being loaded.
Encrypted Ousaban payload being loaded.

Aside from decrypting the payload, the second stage also decrypts the code that will execute Ousaban in runtime, probably to slow down reverse engineering.

Screenshot of second stage decrypting and loading Ousaban payload.
Second stage decrypting and loading Ousaban payload.

We created a Python script that can be used to statically decrypt Ousaban payloads, using the same algorithm found in the malware. The code can be found in our GitHub repository.

Important API calls used by this stage are also dynamically resolved, another common technique to slow down reverse engineering.

Screenshot of APIs dynamically loaded by the malware.
APIs dynamically loaded by the malware.

Ousaban payload

Ousaban is a Delphi banking trojan, mainly focused on stealing sensitive data from financial institutions in Brazil. As previously mentioned, Ousaban shares many similarities with other Brazilian banking malware, such as the algorithm to decrypt the strings and overlay capabilities.

Ousaban commonly packs/protects its payloads with UPX or Enigma.

Example of Ousaban payload packed with UPX.
Ousaban payload packed with UPX.

One of the most characteristic aspects of Brazilian-sourced banking malware is the algorithm used to encrypt/decrypt important strings.

Screenshot of Ousaban encrypted strings.
Ousaban encrypted strings.

The algorithm used as a base by these trojans was originally demonstrated in a Brazilian magazine called “Mestres Da Espionagem Digital” in 2008. Simply put, it parses the hexadecimal string and uses a chained XOR operation with the key and the previous byte of the string.

Screenshot of part of the algorithm to decrypt the strings, commonly found in Brazilian banking malware.
Part of the algorithm to decrypt the strings, commonly found in Brazilian banking malware.

We created a Python script that can be used to decrypt strings from malware that uses this algorithm, such as Ousaban, Guildma, Grandoreiro, and others. The code can be used to decrypt a single string:

Screenshot of decrypting a single string from the malware.
Decrypting a single string from the malware.

Or to decrypt multiple strings at once, saving the result in a JSON file and also providing the option to show in the console.

Screenshot of decrypting multiple strings from the malware.
Decrypting multiple strings from the malware.

Like other Brazilian-sourced malware, Ousaban monitors the title text from the active window and compares it with a list of strings, to verify if the victim is accessing the website or an application of one of its targets.

Exammple of malware monitoring windows titles.
Malware monitoring windows titles.

In the files we analyzed, we found Ousaban targeting over 50 different financial institutions. If the window title matches one of the targets, Ousaban starts the communication with the C2 address, providing the option to the attacker to access the machine remotely.

C2 communication

Ousaban stores the C2 address remotely. In this case, the malware is using Pastebin to fetch the data. In 2021, this malware was also spotted using Google Docs to fetch this information.

Within the files downloaded from the cloud by the first stage, there’s a file named “Host”, which stores the external location of the C2 configuration. The information is encrypted with the same algorithm used in the strings.

Example of C2 configuration stored on Pastebin.
C2 configuration stored on Pastebin.

The data is stored in a dictionary, where the C2 host is also encrypted with the same algorithm used in the strings.

""
Retrieving and decrypting the C2 server address.

Ousaban only starts the communication once a targeted company is identified.

Screenshot of Ousaban C2 communication.
Ousaban C2 communication.

Lastly, the Ousaban samples we analyzed contain a routine to communicate via Telegram using Webhooks, likely to be used as a secondary channel.

Screenshot of part of Ousaban code to communicate via Telegram.
Part of Ousaban code to communicate via Telegram.

Conclusiones

Ousaban is a malware designed to steal sensitive information from several financial institutions, mainly based in Brazil. Ousaban shares many similarities with other Brazilian-based banking trojans, such as Guildma and Grandoreiro. Also, as we demonstrated in this analysis, the attackers behind this threat are abusing multiple cloud services throughout the attack chain. We believe that the use of the cloud will continue to grow among attackers especially due to cost and ease.

Protección

Netskope Threat Labs is actively monitoring this campaign and has ensured coverage for all known threat indicators and payloads. 

  • Netskope Threat Protection
    • Win32.Malware.Heuristic
    • Win32.Infostealer.Heuristic
  • Netskope Advanced Threat Protection provides proactive coverage against this threat.
    • Gen.Malware.Detect.By.StHeur indicates a sample that was detected using static analysis
    • Gen.Malware.Detect.By.Sandbox indicates a sample that was detected by our cloud sandbox

IOCs

All the IOCs related to this campaign and scripts can be found in our GitHub repository.

author image
Gustavo Palazolo
Gustavo Palazolo is an expert in malware analysis, reverse engineering and security research, working many years in projects related to electronic fraud protection. He is currently working on the Netskope Research Team, discovering and analyzing new malware threats.

Stay informed!

Subscribe for the latest from the Netskope Blog