Trojan.Tinba

Posted: June 4, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Ranking:	19,226
Threat Level:	9/10
Infected PCs:	3,612

First Seen:	June 4, 2012
Last Seen:	January 10, 2025
OS(es) Affected:	Windows

Tinba is an exceptionally-small member of the banking Trojan category of malware, with only twenty kilobytes of code packed to the brim with both hard-coded and configurable functions for stealing information and compromising your PC's security. Although almost all Tinba infections have been reported from Turkey, SpywareRemove.com malware researchers also note that Tinba has been seen – albeit in much smaller numbers – in Europe, Asia, North America and even Africa. Propagation vectors for Tinba involve malicious websites that use the ever-prolific Blackhole Exploit Kit (AKA Blacole or BEK) to install Tinba through browser-related exploits. The same defenses that protect your PC from BEK should be sufficient for blocking Tinba installation attacks and an actual infection, since Tinba utilizes code injection and doesn't leave symptoms, should be removed by a suitably adept anti-malware program.

Tinba: the Tiniest Form of Big Trouble You Could Get on Your Hard Drive

Tinba, also known as Zusy or TinyBanker, is installed automatically through your web browser, with a little help from the configurable exploit package known as BEK. You may see a 'Please wait page is loading' error when exposed to a BEK-hosting web page, although other symptoms of an attempt to install Tinba are minimal. Disabling Java and JavaScript can block many of the exploits that Blacole could use to install Tinba, and SpywareRemove.com malware experts also suggest keeping said software, along with Adobe-brand software, updated to cut down on any exploitable vulnerabilities.

Most but not all of Tinba's installations have been seen in Turkey, to the tune of over sixty thousand separate attacks, according to current estimates. So far, SpywareRemove.com malware analysts have observed the following major attacks from Tinba, although Tinba may receive instructions for other functions in the future:

Disabling Firefox's warning message for potential exposure to hazardous websites.
Communicating with a wide range of C&C servers that can be used to compromise your computer. The breadth and complexity of Tinba's server contact system has caused SpywareRemove.com malware experts and others to suspect that Tinba is designed 'professionally' by well-organized and well-funded criminal rings.
Man-in-the-browser attacks that allow Tinba to inject unsafe content into safe web pages – for example, placing phishing forms for personal information in the midst of a bank's login page. Tinba's related functions can also be used to steal information as it's transmitted through your browser. Tinba takes particular care to target Facebook, Microsoft, Google, GMX and HTTPS-related information.

Breaking Out the Virtual Magnifying Glass That Can Spot Tinba

Even though Tinba doesn't use advanced encryption techniques, SpywareRemove.com malware analysts have found that most anti-malware companies have yet to develop a proper ID for Tinba. As part of its default behavior, Tinba injects itself into explorer.exe and svchost.exe, which are native Windows processes. This allows Tinba to launch with Windows and also conceals its attacks from easy surveillance. Additional code injection attacks let Tinba compromise your browser's memory process with specific functions included for Firebox and Internet Explorer.

If you want a good chance of detecting Tinba, your anti-malware software should be updated, and SpywareRemove.com malware experts also suggest using Safe Mode or, if necessary, a boot via USB flash drive during your scans. You should assume that confidential information is compromised if you've been successful in identifying Tinba, and may wish to contact your bank about additional steps to take – besides, of course, changing all of your passwords.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%APPDATA%\AdobeChk\chk.exe

File name: chk.exe
Size: 150.01 KB (150016 bytes)
MD5: 42e844df5f940c6e1975ff7ebf4ba26a
Detection count: 400
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: June 16, 2016

file.exe

File name: file.exe
Size: 19.96 KB (19968 bytes)
MD5: 08ab7f68c6b3a4a2a745cc244d41d213
Detection count: 36
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 7, 2012

%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\cb32.exe

File name: cb32.exe
Size: 334.33 KB (334336 bytes)
MD5: e17606468f7070d63621e0ba3efacd05
Detection count: 14
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Group: Malware file
Last Updated: October 5, 2017

%SYSTEMDRIVE%\Users\<username>\AppData\Roaming\D93D704A\bin.exe

File name: bin.exe
Size: 244.22 KB (244224 bytes)
MD5: f6c5c74dd6805accbf57529b5214b3e0
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\AppData\Roaming\D93D704A\bin.exe
Group: Malware file
Last Updated: June 26, 2020

%USERPROFILE%\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

File name: WINLOGON.EXE
Size: 326.87 KB (326872 bytes)
MD5: 1e100c5435a8025e5bf471b09ec1a151
Detection count: 7
File type: Executable File
Mime Type: unknown/EXE
Path: %USERPROFILE%\Local Settings\Application Data\WINDOWS
Group: Malware file
Last Updated: March 9, 2017

%SystemDrive%\Documents and Settings\All Users\Application Data\Mozilla\Firefox\Profiles\[USER PROFILE NAME]\user.js

File name: %SystemDrive%\Documents and Settings\All Users\Application Data\Mozilla\Firefox\Profiles\[USER PROFILE NAME]\user.js
File type: JavaScript file
Mime Type: unknown/js
Group: Malware file

%SystemDrive%\Documents and Settings\All Users\Application Data\default\bin.exe

File name: %SystemDrive%\Documents and Settings\All Users\Application Data\default\bin.exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

%SystemDrive%\Documents and Settings\All Users\Application Data\default\web.dat

File name: %SystemDrive%\Documents and Settings\All Users\Application Data\default\web.dat
File type: Data file
Mime Type: unknown/dat
Group: Malware file

More files

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%APPDATA%\AdobeChk\chk.exeHKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\"1609" = "0"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"default" = "%SystemDrive%\Documents and Settings\All Users\Application Data\default\bin.exe"

Trojan.Tinba.A