Ousaban Persistence via 'Financeiro' Run Key Registry Value

Luís Marques@remotecodeexecution

•updated Jul 6, 2026•0•0•3

Detects the creation of a registry run key named 'Financeiro' under the Windows 'CurrentVersion\Run' path. This specific registry value is a known indicator of persistence mechanism utilized by the Ousaban banking trojan.