Tinba Banking Trojan Variant

**Executive Summary:** Tinba is a small banking Trojan that injects into system and browser processes to harvest browsing data, login credentials and banking information; it persists by copying itself to a hidden folder under %APPDATA% and adding an autorun registry entry, uses a domain-generation algorithm (DGA) with fast-flux C2 infrastructure and simple XOR-based encryption for C2 communications, and is delivered via spam, drive-by downloads and exploit kits—this report provides behavioral analysis, unpacking details, TTPs and IOCs (domains and IPs).