Tinynuke

Overview

Trojan:Win32/TinyNuke (also known as NukeBot) is an advanced, highly capable banking trojan whose source code was leaked online, leading to widespread proliferation. Strongly influenced by the infamous Zeus trojan, TinyNuke is designed to perform Man-in-the-Browser (MitB) attacks, intercept credentials, and most notably, provide attackers with Hidden VNC (hVNC) access to compromised machines.

Understanding TinyNuke
To the victim, TinyNuke is invisible until their bank account is drained or unauthorized transactions occur. For security analysts, TinyNuke is a tier-one financial threat. Its most dangerous feature is its custom hVNC module. Unlike standard remote desktop tools that lock the user out, hVNC creates a hidden, secondary desktop session on the infected machine. This allows the attacker to open a browser and perform banking transactions from the victim's actual IP address and device, completely bypassing banking fraud detection systems that look for unrecognized devices.

Execution and Web Injects
TinyNuke is distributed via phishing campaigns (`T1566.001`) or exploit kits. Upon execution, it achieves persistence via Registry Run keys. It relies heavily on DLL injection, injecting its payload into `explorer.exe` or web browser processes (`T1055.001`). When the user navigates to a targeted financial site, TinyNuke pulls web inject configurations from its C2 server. It intercepts the browser's API calls (`T1185`) to inject malicious HTML/JavaScript directly into the banking page (`T1111`), stealing credentials before they are encrypted. The hVNC module communicates with the C2, allowing the attacker to silently shadow the user's session.

Indicators of Compromise & Impact
The impact is severe financial fraud. EDR platforms must alert on the injection of unsigned DLLs into `explorer.exe` or browser processes. Network logs will reveal encrypted HTTP traffic to C2 servers, often utilizing DGA (Domain Generation Algorithms) or fast-flux networks. A key indicator of the hVNC module is the anomalous creation of hidden desktop objects within the Windows session.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_TINYNUKE {
    meta:
        description = "Detects Tinynuke (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "tinynuke" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Tinynuke Activity
id: dde61d0fb010a2ce3737f96af9cd397e
status: experimental
description: Detects generic indicators of the tinynuke malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*tinynuke*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint; the attacker has active, real-time control over the user's web browser sessions via the hVNC module.
2. Initiate a mandatory password reset for all financial and corporate accounts accessed from the infected machine, utilizing a known-clean device.
3. Capture a forensic memory image (RAM dump) to extract the decrypted web inject configurations and identify which specific banking portals were targeted.
4. Assume total endpoint compromise; perform a clean OS rebuild and force the revocation of any session tokens or cookies stored on the machine.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not allow the user to log into any sensitive portal to 'check their balance'; the MitB trojan will intercept the login and modify the displayed balance.
2. Avoid relying solely on basic antivirus scans; the hVNC module operates deep within system memory and requires a full system wipe to guarantee eradication.

References & External Analysis

• Search "tinynuke" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Perfectoptimizer
• Securityshield
• Winreg
• Proxyweb
• Popad

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/tinynuke.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.