A family of banking Trojans written in Assembly. They are small in size (about 20 KB) and can also be distributed under the following names: Tinba (Tiny Banker), TR/Dldr.Small.251, Win32/Tinba.AA, Trojan-Spy.Win32.SpyEyes.afkc.
A Trojan, belonging to this family, injects the malicious code into the copy of winver.exe and then looks for the explorer.exe process to infect it (one modification of these Trojans can infect all running processes). Then the Trojan modifies Internet connection settings to monitor traffic over HTTPS. The malware saves the following files on a disk:
- C:\Documents and Settings\All Users\Application Data\default\bin.exe
- C:\Documents and Settings\admin\Application Data\default\web.dat
- C:\Documents and Settings\admin\Application Data\default\cfg.dat
The Trojan modifies the registry to ensure its autorun on system startup. If Firefox is installed on the infected computer, the malicious program saves the C:\Documents and Settings\(Username)\Application Data\Mozilla\Firefox\Profiles\(Profile Name)\user.js script that disables security alerts.
The main purpose of this program is to monitor network traffic and intercept confidential information (including banking information) that the Trojan forwards to remote command and control servers run by cybercriminals.
