Tinukebot

Overview

Trojan:Win32/Tinukebot (widely known as **TinyNuke** or Nuclear Bot) is a sophisticated, commercially sold banking trojan and botnet framework. Its primary objective is to facilitate severe financial fraud by stealing banking credentials, bypassing Multi-Factor Authentication (MFA), and allowing attackers to initiate unauthorized wire transfers directly from the victim's compromised machine. Its source code was leaked in 2017, leading to numerous highly customized, dangerous variants.

Understanding TinyNuke (Banking Trojans)
To a victim, a TinyNuke infection is invisible until money is missing from their accounts. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures. TinyNuke specializes in Man-in-the-Browser (MitB) attacks and Hidden VNC (hVNC) sessions, allowing the attacker to interact with the victim's bank session while the victim is actively logged in, bypassing IP and device fingerprinting checks.

Execution and Web Injection Mechanics
TinyNuke is typically distributed via targeted malspam (`T1566.001`) or dropped by other loaders. Upon execution, it achieves persistence (`T1547.001`) and heavily utilizes API hooking and process injection (`T1055`) to embed itself into web browsers (Chrome, Firefox, IE). When the victim navigates to a targeted banking URL, TinyNuke uses 'Web Injects' (`T1185`) to dynamically alter the HTML/JavaScript of the bank's page before it renders on the screen. It can present fake login fields asking for Social Security numbers or ATM PINs, capturing the data and sending it to the C2 server. Furthermore, its hVNC capability (`T1071.001`) allows the attacker to open a hidden, secondary desktop session on the victim's machine to execute fraudulent transactions using the victim's already-authenticated browser session.

Indicators of Compromise & Impact
The impact is direct, massive financial theft. Host-based IoCs include EDR alerts for known banking trojan signatures, suspicious DLLs injected into browser processes (`chrome.exe`, `firefox.exe`), and unexpected outbound network connections from those browsers to known malicious C2 panels. Network IoCs include the downloading of 'web inject' configuration files from the C2 infrastructure.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_TINUKEBOT {
    meta:
        description = "Detects Tinukebot (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "tinukebot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Tinukebot Activity
id: 456075cd987e549b108408cefeef7a8d
status: experimental
description: Detects generic indicators of the tinukebot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*tinukebot*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network to sever the hVNC connection and prevent the attacker from initiating fraudulent transactions.
2. Contact the victim's financial institutions immediately to freeze accounts and alert them to the high probability of a Man-in-the-Browser compromise.
3. Assume all web credentials stored on or entered into the machine have been stolen, and mandate enterprise-wide password resets.
4. Conduct memory forensics to extract the TinyNuke web inject configuration file, which will reveal the exact list of financial institutions targeted by the threat actor.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely on standard MFA (like SMS codes) to protect accounts if TinyNuke is suspected, as the attacker is operating *from* the authenticated session.
2. Avoid simply running an AV scan and leaving the machine online; banking trojans require a complete wipe and reimage to ensure the deep API hooks are removed.

References & External Analysis

• Search "tinukebot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Nmkfxmdtnmoi
• Krbanker
• Vesenlosow
• Admedia
• Doser

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/tinukebot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.