Skip to content

Malware

TinyNuke

aka NukeBot · Nuclear Bot · MicroBankingTrojan · Xbot

TinyNuke (aka Nuclear Bot) is a fully-fledged banking trojan including HiddenDesktop/VNC server and a reverse socks4 server.

TinyNuke, also known as NukeBot, Nuclear Bot, MicroBankingTrojan, Xbot, is a Windows malware family.

Background

TinyNuke (also called Nuclear Bot) is a complete banking trojan that ships with a HiddenDesktop/VNC server and a reverse socks4 server. In 2016 it was offered on underground marketplaces for $2500. Its author asserted that the malware was built from scratch yet behaved much like the ZeuS banking trojan, able to capture passwords and inject arbitrary content when victims browsed banking websites. He went on to wreck his own standing on hacker forums by pushing his project too aggressively, and as a side effect released the source code on Github. XBot is a derivative of TinyNuke that closely resembles its predecessor.


Source: Malpedia (Fraunhofer FKIE).