Trojan.Tinba

By Domesticus in Trojans

Threat Scorecard

Ranking:	17,978
Threat Level:	90 % (High)
Infected Computers:	1,538

First Seen:	June 4, 2012
Last Seen:	December 17, 2022
OS(es) Affected:	Windows

Tinba is a banking Trojan whose purpose is to steal online banking credentials that victims enter in their browser. Tinba is primarily spread through malvertising campaigns, exploit kits and the ever-topical spam email campaigns. The main targets of the Trojan are bank customers residing in the United States and Europe.

The way Trojan.Tinba steals its victims online banking information is by using code injections that modify the portal pages of legitimate banking websites. The victim is presented with a very legitimate-looking, yet completely fake and malicious login interface for their respective bank. Using this login interface to enter sensitive data results in the login credentials being syphoned to the bad actors behind the Trojan.

Once the victim hits specific banking portals that are hard-coded in the malware, the original login interface is swapped with the malicious one through web injection. The web code injections are kept on the victim's hard drive and are encrypted using a key. The key itself is the name of the directory where the injection files are kept. Once it needs to inject the malicious code, Tinba decrypts it entirely and injects it in the browser's memory footprint with no other safety measures, which makes spotting the issue relatively easy for security researchers. The code injection itself and the fake info-stealing login interface use code that is very similar to that used by the Zeus banking Trojan.

Tinba is also known for resorting to social engineering tactics to urge its victims to enter their credentials in the fake login forms, even if the user did not originally intend to do any online banking. Such tactics include fake messages that the victim received an erroneous bank transfer and needs to refund the sum immediately, to avoid further trouble. Similar scare tactics are used by a lot of other types of malware, including rogue antivirus software and some niche cases of ransomware that attempt to scare the user into submission.

SpyHunter Detects & Remove Trojan.Tinba

File System Details

Trojan.Tinba may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	chk.exe	34c809f63528376356a5d85795f5ae22	224
Name: chk.exe MD5: 34c809f63528376356a5d85795f5ae22 Size: 108.03 KB (108032 bytes) Detections: 224 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
2.	chk.exe	42e844df5f940c6e1975ff7ebf4ba26a	171
Name: chk.exe MD5: 42e844df5f940c6e1975ff7ebf4ba26a Size: 150.01 KB (150016 bytes) Detections: 171 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
3.	chk.exe	15159e7dce479b2d5e378f16af68af2e	132
Name: chk.exe MD5: 15159e7dce479b2d5e378f16af68af2e Size: 131.07 KB (131072 bytes) Detections: 132 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: May 6, 2020
4.	chk.exe	4a98ff2dc2428e00cc9d62d174d449b6	132
Name: chk.exe MD5: 4a98ff2dc2428e00cc9d62d174d449b6 Size: 131.07 KB (131072 bytes) Detections: 132 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
5.	chk.exe	da6115918cdcf1bf94701330655f059a	123
Name: chk.exe MD5: da6115918cdcf1bf94701330655f059a Size: 131.07 KB (131072 bytes) Detections: 123 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
6.	chk.exe	043eeec8f688100ac142f6b344c19ef8	96
Name: chk.exe MD5: 043eeec8f688100ac142f6b344c19ef8 Size: 131.07 KB (131072 bytes) Detections: 96 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
7.	chk.exe	e16f974e3def7d9c16aa61f60a26abd7	74
Name: chk.exe MD5: e16f974e3def7d9c16aa61f60a26abd7 Size: 90.11 KB (90112 bytes) Detections: 74 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
8.	chk.exe	a18096552f1f7faedde02d4236c7a095	71
Name: chk.exe MD5: a18096552f1f7faedde02d4236c7a095 Size: 98.3 KB (98304 bytes) Detections: 71 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
9.	chk.exe	5e00fd790838796332d2c754ef7b8dd0	59
Name: chk.exe MD5: 5e00fd790838796332d2c754ef7b8dd0 Size: 86.01 KB (86016 bytes) Detections: 59 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: November 29, 2020
10.	chk.exe	3ab9d894bfb21c2143c6b4b29e7a435c	50
Name: chk.exe MD5: 3ab9d894bfb21c2143c6b4b29e7a435c Size: 141.31 KB (141312 bytes) Detections: 50 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: July 25, 2019
11.	chk.exe	70e91a8ef84783adc3c550bf3d5969f3	47
Name: chk.exe MD5: 70e91a8ef84783adc3c550bf3d5969f3 Size: 118.78 KB (118784 bytes) Detections: 47 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
12.	chk.exe	d9f235cdf96453e74d184b7f5d1048a6	41
Name: chk.exe MD5: d9f235cdf96453e74d184b7f5d1048a6 Size: 102.4 KB (102400 bytes) Detections: 41 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
13.	chk.exe	08ab359905a8316f9d86f0fd67b732a1	35
Name: chk.exe MD5: 08ab359905a8316f9d86f0fd67b732a1 Size: 133.12 KB (133120 bytes) Detections: 35 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
14.	chk.exe	b03787ba7021fb1394f6579a8f511ab3	32
Name: chk.exe MD5: b03787ba7021fb1394f6579a8f511ab3 Size: 92.39 KB (92397 bytes) Detections: 32 Type: Executable File Path: %APPDATA%\AdobeChk\ Group: Malware file Last Updated: June 16, 2016
15.	bin.exe	f6c5c74dd6805accbf57529b5214b3e0	4
Name: bin.exe MD5: f6c5c74dd6805accbf57529b5214b3e0 Size: 244.22 KB (244224 bytes) Detections: 4 Type: Executable File Path: %SYSTEMDRIVE%\Users\user\AppData\Roaming\D93D704A\bin.exe\ Group: Malware file Last Updated: June 26, 2020
16.	WINLOGON.EXE	1e100c5435a8025e5bf471b09ec1a151	3
Name: WINLOGON.EXE MD5: 1e100c5435a8025e5bf471b09ec1a151 Size: 326.87 KB (326872 bytes) Detections: 3 Type: Executable File Path: %USERPROFILE%\Local Settings\Application Data\WINDOWS\ Group: Malware file Last Updated: March 9, 2017
17.	file.exe	08ab7f68c6b3a4a2a745cc244d41d213	1
Name: file.exe MD5: 08ab7f68c6b3a4a2a745cc244d41d213 Size: 19.96 KB (19968 bytes) Detections: 1 Type: Executable File Group: Malware file Last Updated: June 7, 2012
18.	%SystemDrive%\Documents and Settings\All Users\Application Data\default\bin.exe
Name: %SystemDrive%\Documents and Settings\All Users\Application Data\default\bin.exe Type: Executable File Group: Malware file
19.	%SystemDrive%\Documents and Settings\All Users\Application Data\default\web.dat
Name: %SystemDrive%\Documents and Settings\All Users\Application Data\default\web.dat Type: Data file Group: Malware file

Registry Details

Trojan.Tinba may create the following registry entry or registry entries:

Regexp file mask

%APPDATA%\AdobeChk\chk.exe

HKEY..\..\..\..{RegistryKeys}

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\"1609" = "0"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"default" = "%SystemDrive%\Documents and Settings\All Users\Application Data\default\bin.exe"