Tinba (Malware Family)

Tinba

aka: Zusy, TinyBanker, Illi

URLhaus

F-Secure notes that TinyBanker or short Tinba is usually distributed through malvertising (advertising content that leads the user to sites hosting malicious threats), exploit kits and spam email campaigns. According to news reports, Tinba has been found targeting bank customers in the United States and Europe.

If Tinba successfully infects a device, it can steal banking and personal information through webinjects. To do this, the malware monitors the user's browser activity and if specific banking portals are visited, Tinba injects code to present the victim with fake web forms designed to mimic the legitimate web site. The malware then tricks them into entering their personal information, log-in credentials, etc in the legitimate-looking page.

Tinba may also display socially-engineered messages to lure or pressure the user into entering their information on the fake page; for example, a message may be shown which attempts to convince the victim that funds were accidentally deposited to his account and must be refunded immediately.

References

2020-07-29 ⋅ ESET Research ⋅ welivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor

Yara Rules

[TLP:WHITE] win_tinba_auto (20220808 | Detects win.tinba.)

rule win_tinba_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-08-05"
        version = "1"
        description = "Detects win.tinba."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba"
        malpedia_rule_date = "20220805"
        malpedia_hash = "6ec06c64bcfdbeda64eff021c766b4ce34542b71"
        malpedia_version = "20220808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b7508 ad 50 56 }
            // n = 4, score = 1100
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   ad                   | lodsd               eax, dword ptr [esi]
            //   50                   | push                eax
            //   56                   | push                esi

        $sequence_1 = { 8b4510 aa 8b450c ab }
            // n = 4, score = 1100
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   aa                   | stosb               byte ptr es:[edi], al
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   ab                   | stosd               dword ptr es:[edi], eax

        $sequence_2 = { 6a00 ff750c 6a00 6a00 ff7508 }
            // n = 5, score = 1000
            //   6a00                 | push                0
            //   ff750c               | push                dword ptr [ebp + 0xc]
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   ff7508               | push                dword ptr [ebp + 8]

        $sequence_3 = { 8a241f 88240f 88041f 41 }
            // n = 4, score = 1000
            //   8a241f               | mov                 ah, byte ptr [edi + ebx]
            //   88240f               | mov                 byte ptr [edi + ecx], ah
            //   88041f               | mov                 byte ptr [edi + ebx], al
            //   41                   | inc                 ecx

        $sequence_4 = { 8b7004 8d7e04 8b0e 3b4d10 7603 8b4d10 51 }
            // n = 7, score = 900
            //   8b7004               | mov                 esi, dword ptr [eax + 4]
            //   8d7e04               | lea                 edi, [esi + 4]
            //   8b0e                 | mov                 ecx, dword ptr [esi]
            //   3b4d10               | cmp                 ecx, dword ptr [ebp + 0x10]
            //   7603                 | jbe                 5
            //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
            //   51                   | push                ecx

        $sequence_5 = { 48 8d3daa020000 b301 80ff38 7415 }
            // n = 5, score = 900
            //   48                   | dec                 eax
            //   8d3daa020000         | lea                 edi, [0x2aa]
            //   b301                 | mov                 bl, 1
            //   80ff38               | cmp                 bh, 0x38
            //   7415                 | je                  0x17

        $sequence_6 = { 89f7 b0e9 48 29fe 48 83ee05 aa }
            // n = 7, score = 900
            //   89f7                 | mov                 edi, esi
            //   b0e9                 | mov                 al, 0xe9
            //   48                   | dec                 eax
            //   29fe                 | sub                 esi, edi
            //   48                   | dec                 eax
            //   83ee05               | sub                 esi, 5
            //   aa                   | stosb               byte ptr es:[edi], al

        $sequence_7 = { 6a04 6800300000 6800600000 6a00 }
            // n = 4, score = 900
            //   6a04                 | push                4
            //   6800300000           | push                0x3000
            //   6800600000           | push                0x6000
            //   6a00                 | push                0

        $sequence_8 = { 8d7a23 f7423508000000 7401 a5 f7423504000000 7401 a4 }
            // n = 7, score = 900
            //   8d7a23               | lea                 edi, [edx + 0x23]
            //   f7423508000000       | test                dword ptr [edx + 0x35], 8
            //   7401                 | je                  3
            //   a5                   | movsd               dword ptr es:[edi], dword ptr [esi]
            //   f7423504000000       | test                dword ptr [edx + 0x35], 4
            //   7401                 | je                  3
            //   a4                   | movsb               byte ptr es:[edi], byte ptr [esi]

        $sequence_9 = { f3a4 b868747470 ab 8b4d08 8b4114 83f8fd 7506 }
            // n = 7, score = 900
            //   f3a4                 | rep movsb           byte ptr es:[edi], byte ptr [esi]
            //   b868747470           | mov                 eax, 0x70747468
            //   ab                   | stosd               dword ptr es:[edi], eax
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   8b4114               | mov                 eax, dword ptr [ecx + 0x14]
            //   83f8fd               | cmp                 eax, -3
            //   7506                 | jne                 8

        $sequence_10 = { 66b80d0a 66ab b855736572 ab b82d416765 ab }
            // n = 6, score = 900
            //   66b80d0a             | mov                 ax, 0xa0d
            //   66ab                 | stosw               word ptr es:[edi], ax
            //   b855736572           | mov                 eax, 0x72657355
            //   ab                   | stosd               dword ptr es:[edi], eax
            //   b82d416765           | mov                 eax, 0x6567412d
            //   ab                   | stosd               dword ptr es:[edi], eax

        $sequence_11 = { 66ab b8436f6f6b ab b869653a20 }
            // n = 4, score = 900
            //   66ab                 | stosw               word ptr es:[edi], ax
            //   b8436f6f6b           | mov                 eax, 0x6b6f6f43
            //   ab                   | stosd               dword ptr es:[edi], eax
            //   b869653a20           | mov                 eax, 0x203a6569

        $sequence_12 = { 57 48 89ce 49 89c8 31c9 30c0 }
            // n = 7, score = 900
            //   57                   | push                edi
            //   48                   | dec                 eax
            //   89ce                 | mov                 esi, ecx
            //   49                   | dec                 ecx
            //   89c8                 | mov                 eax, ecx
            //   31c9                 | xor                 ecx, ecx
            //   30c0                 | xor                 al, al

    condition:
        7 of them and filesize < 57344
}

[TLP:WHITE] win_tinba_w0 (20170605 | Tinba 2 (DGA) banking trojan)

rule win_tinba_w0 {
    meta:
        author = "n3sfox <n3sfox@gmail.com>"
        date = "2015/11/07"
        description = "Tinba 2 (DGA) banking trojan"
        reference = "https://securityintelligence.com/tinba-malware-reloaded-and-attacking-banks-around-the-world"
        filetype = "memory"
        hash = "c7f662594f07776ab047b322150f6ed0"
        hash = "dc71ef1e55f1ddb36b3c41b1b95ae586"
        hash = "b788155cb82a7600f2ed1965cffc1e88"
        source = "https://github.com/mattulm/sfiles_yara/blob/master/malware/tinba2.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinba"
        malpedia_version = "20170605"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $str3 = "NtCreateUserProcess"
        $str4 = "NtQueryDirectoryFile"
        $str5 = "RtlCreateUserThread"
        $str6 = "DeleteUrlCacheEntry"
        $str7 = "PR_Read"
        $str8 = "PR_Write"
        $pubkey = "BEGIN PUBLIC KEY"
        $code1 = {50 87 44 24 04 6A ?? E8}

    condition:
        all of ($str*) and $pubkey and $code1
}

Download all Yara Rules

Tinba Propose Change

References

Yara Rules

Tinba