SYMBOLCOMMON_NAMEaka. SYNONYMS
win.tinba (Back to overview)

Tinba

aka: Zusy, TinyBanker, Illi
VTCollection     URLhaus    

F-Secure notes that TinyBanker or short Tinba is usually distributed through malvertising (advertising content that leads the user to sites hosting malicious threats), exploit kits and spam email campaigns. According to news reports, Tinba has been found targeting bank customers in the United States and Europe.

If Tinba successfully infects a device, it can steal banking and personal information through webinjects. To do this, the malware monitors the user's browser activity and if specific banking portals are visited, Tinba injects code to present the victim with fake web forms designed to mimic the legitimate web site. The malware then tricks them into entering their personal information, log-in credentials, etc in the legitimate-looking page.

Tinba may also display socially-engineered messages to lure or pressure the user into entering their information on the fake page; for example, a message may be shown which attempts to convince the victim that funds were accidentally deposited to his account and must be refunded immediately.

References
2022-02-11 ⋅ Cisco Talos ⋅ Talos
Threat Roundup for February 4 to February 11
DarkComet Ghost RAT Loki Password Stealer (PWS) Tinba Tofsee Zeus
2020-08-09 ⋅ F5 Labs ⋅ Debbie Walkowski, Remi Cohen
Banking Trojans: A Reference Guide to the Malware Family Tree
BackSwap Carberp Citadel DanaBot Dridex Dyre Emotet Gozi Kronos PandaBanker Ramnit Shylock SpyEye Tinba TrickBot Vawtrak Zeus
2020-07-29 ⋅ ESET Research ⋅ welivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor
2019-08-13 ⋅ Adalogics ⋅ David Korczynski
The state of advanced code injections
Dridex Emotet Tinba
2019-03-13 ⋅ Cylance ⋅ Tatsuya Hasegawa
BlackBerry Cylance vs. Tinba Banking Trojan
Tinba
2018-07-05 ⋅ Zscaler ⋅ Dhanalakshmi
A Look At Recent Tinba Banking Trojan Variant
Tinba
2015-08-12 ⋅ SecurityIntelligence ⋅ Limor Kessem
Tinba Trojan Sets Its Sights on Romania
Tinba
2015-06-18 ⋅ SWITCH Security Blog ⋅ Slavo Greminger
So Long, and Thanks for All the Domains
Tinba
2014-09-22 ⋅ SecurityIntelligence ⋅ Assaf Regev, Tal Darsan
Tinba Malware Reloaded and Attacking Banks Around the World
Tinba
2014-07-16 ⋅ StopMalvertising ⋅ Kimberly
Mini Analysis of the TinyBanker Tinba
Tinba
2012-06-06 ⋅ Contagio Dump ⋅ Mila Parkour
Tinba / Zusy - tiny banker trojan
Tinba
2012-06-04 ⋅ John Leyden
Small banking Trojan poses major risk
Tinba
2012-01-01 ⋅ CSIS Trend Micro ⋅ Feike Hacquebord (Trend Micro), Peter Kruse (CSIS), Robert McArdle (Trend Micro)
W32.Tinba (Tinybanker) The Turkish Incident
Tinba
Yara Rules
[TLP:WHITE] win_tinba_auto (20260504 | Detects win.tinba.)
rule win_tinba_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.tinba."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b4510 aa 8b450c ab }
            // n = 4, score = 1100
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   aa                   | stosb               byte ptr es:[edi], al
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   ab                   | stosd               dword ptr es:[edi], eax

        $sequence_1 = { 8b7508 ad 50 56 }
            // n = 4, score = 1100
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   ad                   | lodsd               eax, dword ptr [esi]
            //   50                   | push                eax
            //   56                   | push                esi

        $sequence_2 = { 8a241f 88240f 88041f 41 }
            // n = 4, score = 1000
            //   8a241f               | mov                 ah, byte ptr [edi + ebx]
            //   88240f               | mov                 byte ptr [edi + ecx], ah
            //   88041f               | mov                 byte ptr [edi + ebx], al
            //   41                   | inc                 ecx

        $sequence_3 = { 6a00 6a00 6a00 ff750c 6a00 6a00 ff7508 }
            // n = 7, score = 1000
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   ff750c               | push                dword ptr [ebp + 0xc]
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   ff7508               | push                dword ptr [ebp + 8]

        $sequence_4 = { ab 48 83ec20 4c 89f1 48 c7c240000000 }
            // n = 7, score = 900
            //   ab                   | stosd               dword ptr es:[edi], eax
            //   48                   | dec                 eax
            //   83ec20               | sub                 esp, 0x20
            //   4c                   | dec                 esp
            //   89f1                 | mov                 ecx, esi
            //   48                   | dec                 eax
            //   c7c240000000         | mov                 edx, 0x40

        $sequence_5 = { b82d416765 ab b86e743a20 ab }
            // n = 4, score = 900
            //   b82d416765           | mov                 eax, 0x6567412d
            //   ab                   | stosd               dword ptr es:[edi], eax
            //   b86e743a20           | mov                 eax, 0x203a746e
            //   ab                   | stosd               dword ptr es:[edi], eax

        $sequence_6 = { 8b7d0c 83c707 8b4508 83e00f }
            // n = 4, score = 900
            //   8b7d0c               | mov                 edi, dword ptr [ebp + 0xc]
            //   83c707               | add                 edi, 7
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   83e00f               | and                 eax, 0xf

        $sequence_7 = { 834a3504 80f903 7430 3c04 752c }
            // n = 5, score = 900
            //   834a3504             | or                  dword ptr [edx + 0x35], 4
            //   80f903               | cmp                 cl, 3
            //   7430                 | je                  0x32
            //   3c04                 | cmp                 al, 4
            //   752c                 | jne                 0x2e

        $sequence_8 = { 7304 0430 eb02 0437 aa c14d0804 }
            // n = 6, score = 900
            //   7304                 | jae                 6
            //   0430                 | add                 al, 0x30
            //   eb02                 | jmp                 4
            //   0437                 | add                 al, 0x37
            //   aa                   | stosb               byte ptr es:[edi], al
            //   c14d0804             | ror                 dword ptr [ebp + 8], 4

        $sequence_9 = { 7403 b073 aa b83a2f2f00 ab 4f }
            // n = 6, score = 900
            //   7403                 | je                  5
            //   b073                 | mov                 al, 0x73
            //   aa                   | stosb               byte ptr es:[edi], al
            //   b83a2f2f00           | mov                 eax, 0x2f2f3a
            //   ab                   | stosd               dword ptr es:[edi], eax
            //   4f                   | dec                 edi

        $sequence_10 = { 8b4114 83f8fd 7506 8b4108 8b4014 }
            // n = 5, score = 900
            //   8b4114               | mov                 eax, dword ptr [ecx + 0x14]
            //   83f8fd               | cmp                 eax, -3
            //   7506                 | jne                 8
            //   8b4108               | mov                 eax, dword ptr [ecx + 8]
            //   8b4014               | mov                 eax, dword ptr [eax + 0x14]

        $sequence_11 = { 7407 814a3500020000 f6c320 7407 814a3500080000 4c 29c6 }
            // n = 7, score = 900
            //   7407                 | je                  9
            //   814a3500020000       | or                  dword ptr [edx + 0x35], 0x200
            //   f6c320               | test                bl, 0x20
            //   7407                 | je                  9
            //   814a3500080000       | or                  dword ptr [edx + 0x35], 0x800
            //   4c                   | dec                 esp
            //   29c6                 | sub                 esi, eax

        $sequence_12 = { 7442 8a4218 24f8 3cb8 7514 807a0801 750e }
            // n = 7, score = 900
            //   7442                 | je                  0x44
            //   8a4218               | mov                 al, byte ptr [edx + 0x18]
            //   24f8                 | and                 al, 0xf8
            //   3cb8                 | cmp                 al, 0xb8
            //   7514                 | jne                 0x16
            //   807a0801             | cmp                 byte ptr [edx + 8], 1
            //   750e                 | jne                 0x10

    condition:
        7 of them and filesize < 57344
}
[TLP:WHITE] win_tinba_w0   (20170605 | Tinba 2 (DGA) banking trojan)
rule win_tinba_w0 {
    meta:
        author = "n3sfox <n3sfox@gmail.com>"
        date = "2015/11/07"
        description = "Tinba 2 (DGA) banking trojan"
        reference = "https://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world"
        filetype = "memory"
        hash = "c7f662594f07776ab047b322150f6ed0"
        hash = "dc71ef1e55f1ddb36b3c41b1b95ae586"
        hash = "b788155cb82a7600f2ed1965cffc1e88"
        source = "https://github.com/mattulm/sfiles_yara/blob/master/malware/tinba2.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba"
        malpedia_version = "20170605"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $str3 = "NtCreateUserProcess"
        $str4 = "NtQueryDirectoryFile"
        $str5 = "RtlCreateUserThread"
        $str6 = "DeleteUrlCacheEntry"
        $str7 = "PR_Read"
        $str8 = "PR_Write"
        $pubkey = "BEGIN PUBLIC KEY"
        $code1 = {50 87 44 24 04 6A ?? E8}

    condition:
        all of ($str*) and $pubkey and $code1
}
Download all Yara Rules