Trojan.Tinba
Posted: June 4, 2012
Threat Metric
The following fields listed on the Threat Meter containing a specific value, are explained in detail below:
Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.
Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.
Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.
Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.
% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.
| Threat Level: | 9/10 |
|---|---|
| Infected PCs: | 3,604 |
| First Seen: | June 4, 2012 |
|---|---|
| Last Seen: | February 16, 2023 |
| OS(es) Affected: | Windows |
Tinba is an exceptionally-small member of the banking Trojan category of malware, with only twenty kilobytes of code packed to the brim with both hard-coded and configurable functions for stealing information and compromising your PC's security. Although almost all Tinba infections have been reported from Turkey, SpywareRemove.com malware researchers also note that Tinba has been seen – albeit in much smaller numbers – in Europe, Asia, North America and even Africa. Propagation vectors for Tinba involve malicious websites that use the ever-prolific Blackhole Exploit Kit (AKA Blacole or BEK) to install Tinba through browser-related exploits. The same defenses that protect your PC from BEK should be sufficient for blocking Tinba installation attacks and an actual infection, since Tinba utilizes code injection and doesn't leave symptoms, should be removed by a suitably adept anti-malware program.
Tinba: the Tiniest Form of Big Trouble You Could Get on Your Hard Drive
Tinba, also known as Zusy or TinyBanker, is installed automatically through your web browser, with a little help from the configurable exploit package known as BEK. You may see a 'Please wait page is loading' error when exposed to a BEK-hosting web page, although other symptoms of an attempt to install Tinba are minimal. Disabling Java and JavaScript can block many of the exploits that Blacole could use to install Tinba, and SpywareRemove.com malware experts also suggest keeping said software, along with Adobe-brand software, updated to cut down on any exploitable vulnerabilities.
Most but not all of Tinba's installations have been seen in Turkey, to the tune of over sixty thousand separate attacks, according to current estimates. So far, SpywareRemove.com malware analysts have observed the following major attacks from Tinba, although Tinba may receive instructions for other functions in the future:
- Disabling Firefox's warning message for potential exposure to hazardous websites.
- Communicating with a wide range of C&C servers that can be used to compromise your computer. The breadth and complexity of Tinba's server contact system has caused SpywareRemove.com malware experts and others to suspect that Tinba is designed 'professionally' by well-organized and well-funded criminal rings.
- Man-in-the-browser attacks that allow Tinba to inject unsafe content into safe web pages – for example, placing phishing forms for personal information in the midst of a bank's login page. Tinba's related functions can also be used to steal information as it's transmitted through your browser. Tinba takes particular care to target Facebook, Microsoft, Google, GMX and HTTPS-related information.
Breaking Out the Virtual Magnifying Glass That Can Spot Tinba
Even though Tinba doesn't use advanced encryption techniques, SpywareRemove.com malware analysts have found that most anti-malware companies have yet to develop a proper ID for Tinba. As part of its default behavior, Tinba injects itself into explorer.exe and svchost.exe, which are native Windows processes. This allows Tinba to launch with Windows and also conceals its attacks from easy surveillance. Additional code injection attacks let Tinba compromise your browser's memory process with specific functions included for Firebox and Internet Explorer.
If you want a good chance of detecting Tinba, your anti-malware software should be updated, and SpywareRemove.com malware experts also suggest using Safe Mode or, if necessary, a boot via USB flash drive during your scans. You should assume that confidential information is compromised if you've been successful in identifying Tinba, and may wish to contact your bank about additional steps to take – besides, of course, changing all of your passwords.
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 108.03 KB (108032 bytes)
MD5: 34c809f63528376356a5d85795f5ae22
Detection count: 525
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: June 16, 2016
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 150.01 KB (150016 bytes)
MD5: 42e844df5f940c6e1975ff7ebf4ba26a
Detection count: 400
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: June 16, 2016
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 131.07 KB (131072 bytes)
MD5: 15159e7dce479b2d5e378f16af68af2e
Detection count: 309
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: May 6, 2020
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 131.07 KB (131072 bytes)
MD5: 4a98ff2dc2428e00cc9d62d174d449b6
Detection count: 309
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: June 16, 2016
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 131.07 KB (131072 bytes)
MD5: da6115918cdcf1bf94701330655f059a
Detection count: 288
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: June 16, 2016
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 131.07 KB (131072 bytes)
MD5: 043eeec8f688100ac142f6b344c19ef8
Detection count: 225
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: June 16, 2016
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 90.11 KB (90112 bytes)
MD5: e16f974e3def7d9c16aa61f60a26abd7
Detection count: 173
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: June 16, 2016
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 86.01 KB (86016 bytes)
MD5: 5e00fd790838796332d2c754ef7b8dd0
Detection count: 138
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: November 29, 2020
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 141.31 KB (141312 bytes)
MD5: 3ab9d894bfb21c2143c6b4b29e7a435c
Detection count: 117
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: July 25, 2019
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 118.78 KB (118784 bytes)
MD5: 70e91a8ef84783adc3c550bf3d5969f3
Detection count: 110
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: June 16, 2016
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 102.4 KB (102400 bytes)
MD5: d9f235cdf96453e74d184b7f5d1048a6
Detection count: 96
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: June 16, 2016
%APPDATA%\AdobeChk\chk.exe
File name: chk.exeSize: 133.12 KB (133120 bytes)
MD5: 08ab359905a8316f9d86f0fd67b732a1
Detection count: 82
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\AdobeChk
Group: Malware file
Last Updated: June 16, 2016
file.exe
File name: file.exeSize: 19.96 KB (19968 bytes)
MD5: 08ab7f68c6b3a4a2a745cc244d41d213
Detection count: 36
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
Last Updated: June 7, 2012
%SYSTEMDRIVE%\Users\<username>\AppData\Roaming\D93D704A\bin.exe
File name: bin.exeSize: 244.22 KB (244224 bytes)
MD5: f6c5c74dd6805accbf57529b5214b3e0
Detection count: 9
File type: Executable File
Mime Type: unknown/exe
Path: %SYSTEMDRIVE%\Users\<username>\AppData\Roaming\D93D704A\bin.exe
Group: Malware file
Last Updated: June 26, 2020
%SystemDrive%\Documents and Settings\All Users\Application Data\Mozilla\Firefox\Profiles\[USER PROFILE NAME]\user.js
File name: %SystemDrive%\Documents and Settings\All Users\Application Data\Mozilla\Firefox\Profiles\[USER PROFILE NAME]\user.jsFile type: JavaScript file
Mime Type: unknown/js
Group: Malware file
%SystemDrive%\Documents and Settings\All Users\Application Data\default\bin.exe
File name: %SystemDrive%\Documents and Settings\All Users\Application Data\default\bin.exeFile type: Executable File
Mime Type: unknown/exe
Group: Malware file
%SystemDrive%\Documents and Settings\All Users\Application Data\default\web.dat
File name: %SystemDrive%\Documents and Settings\All Users\Application Data\default\web.datFile type: Data file
Mime Type: unknown/dat
Group: Malware file
Registry Modifications
Regexp file mask%APPDATA%\AdobeChk\chk.exeHKEY..\..\{Value}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\"1609" = "0"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"default" = "%SystemDrive%\Documents and Settings\All Users\Application Data\default\bin.exe"
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.